dynamic-agents
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill directs the agent to read
~/.codex/config.tomlto verify model versions. Accessing configuration files in the home directory is a security risk as they often store sensitive credentials like API keys for CLI tools. - [EXTERNAL_DOWNLOADS]: The skill recommends using an external Codex CLI plugin from OpenAI's GitHub repository to enable advanced features.
- [PROMPT_INJECTION]: The instructions reference non-standard or future model versions (e.g., 'GPT-5.6-sol+', 'Fable'), which could be intended to bypass constraints or influence the agent's behavior.
- [COMMAND_EXECUTION]: The skill uses Agent and Workflow tools to orchestrate sub-tasks, creating a surface for indirect prompt injection where data from one sub-task could influence subsequent agents.
- Ingestion points: Repository contents and task descriptions ingested during decomposition.
- Boundary markers: Instructions require self-contained briefs for sub-agents.
- Capability inventory: Spawns sub-agents and manages background workflows.
- Sanitization: Lacks explicit evidence of sanitization for data passed between agents.
Audit Metadata