create-plan
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is configured to read from
~/.codex/repo_profile.jsonas a fallback reference. Although this path appears to be a tool-specific configuration directory, accessing files within the user's home directory is a sensitive operation. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted content from the repository to generate its output.
- Ingestion points: Reads repository documentation (README, ARCHITECTURE, ROADMAP, etc.) and repository-local profile files (
REPO_PROFILE.json). - Boundary markers: Absent. The skill does not define specific delimiters or instructions to ignore embedded commands within the files it reads.
- Capability inventory: The skill performs read-only file system access across the repository and specific configuration paths.
- Sanitization: Absent. There is no explicit instruction to sanitize or validate the content extracted from repository files before using it to construct the final plan.
Audit Metadata