codex-image-to-eagle
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script resolves and executes Model Context Protocol (MCP) transport commands by spawning child processes based on configurations found in the local
~/.codex/config.tomlfile or provided via command-line arguments. - [COMMAND_EXECUTION]: Utilizes
child_process.spawnto launch local helper tools and proxies necessary for asset management integration with Eagle. - [DATA_EXPOSURE]: Accesses files within the
~/.codexdirectory to retrieve generated images and application configuration data, which is appropriate for its stated archival functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied prompt text to be stored as metadata within the Eagle application.
- Ingestion points: Command-line arguments
--prompt,--prompt-file, and--prompt-stdininscripts/archive-codex-image-to-eagle.js. - Boundary markers: None identified; the prompt content is stored as a literal string.
- Capability inventory: Includes local file system access, local network communication, and subprocess execution.
- Sanitization: The script validates file existence and supported image formats but does not sanitize the contents of the prompt text.
Audit Metadata