ask-codex
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs shell commands for the
codexCLI by interpolating user-provided summaries and project context (such as file paths) directly into a string. If these inputs contain shell metacharacters like backticks or dollar signs, they could lead to unintended command execution within the Bash tool. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates untrusted project data into its decision-making flow.
- Ingestion points: The skill grants the
codextool full access to project files and specifically targets./CLAUDE.mdas a context document. - Boundary markers: The prompt template used to consult the model lacks delimiters or clear instructions to distinguish between instructions and data from the project.
- Capability inventory: The skill uses the Bash tool for execution and explicitly instructs the agent to implement code changes based on the external tool's analysis.
- Sanitization: There is no evidence of sanitizing project content or escaping shell arguments before they are passed to the CLI or processed for implementation.
Audit Metadata