vp-interaction-routing
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The bridge script spawns the codex binary from the local ChatGPT application bundle to establish a connection to its app-server (scripts/codex-cua-bridge.mjs).
- [DYNAMIC_EXECUTION]: The skill generates and executes JavaScript snippets within a persistent session to perform Computer Use actions through the Codex environment (scripts/codex-cua-bridge.mjs).
- [PERSISTENCE]: The documentation provides instructions for the persistent registration of the bridge as a Model Context Protocol (MCP) server in the host agent configuration (references/codex-cua-bridge.md).
- [DATA_EXFILTRATION]: The skill captures accessibility trees and screenshots of applications which may contain sensitive information, and it notes that certain browser state files used by associated tools contain plaintext session tokens (references/browser-routing.md, scripts/codex-cua-bridge.mjs).
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external content from web pages and native application interfaces that could contain malicious instructions.
- Ingestion points: Web page content and native application accessibility trees (SKILL.md, scripts/codex-cua-bridge.mjs).
- Boundary markers: Includes explicit instructions to treat external content as untrusted data rather than agent instructions (SKILL.md, references/browser-routing.md).
- Capability inventory: Mutating user interface actions such as clicking, typing, and dragging, as well as session lifecycle management (scripts/codex-cua-bridge.mjs).
- Sanitization: Employs structured JSON handling for communication with the bridge service, avoiding direct interpolation of untrusted data into execution strings (scripts/codex-cua-bridge.mjs).
Audit Metadata