baoyu-image-gen

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The codex-imagegen wrapper intentionally spawns the Codex CLI with "--sandbox danger-full-access" and instructs the agent (via a plaintext instruction containing absolute paths and file operations) to access and move files from the user's CODEX_HOME, which creates a local remote-code-execution/data-exfiltration capability that an agent could abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). Outsider-authored free text can be loaded from user-supplied prompt files/batch files (e.g., --promptfiles, --batchfile → loadPromptForArgs → prepareBatchTasks) and then embedded verbatim into the Codex runtime instruction/prompt (scripts/codex-imagegen/main.ts → loadPrompt + buildInstruction), which is read by the underlying agent LLM; this is a classic prompt-injection path because prompt-file contents are not sanitized and can include free-form attacker text.