refactor-agents-md
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves reading and interpreting instructions from AGENTS.md files located in project directories, which are potentially controlled by third parties.
- Ingestion points: Processes content from user-level ~/.codex/AGENTS.md, project root AGENTS.md, and nested AGENTS.md files within the file system (SKILL.md).
- Boundary markers: Not explicitly defined; the instructions do not mandate the use of delimiters or 'ignore' commands when processing the content of the target files.
- Capability inventory: The skill is configured to use WebFetch for network operations, Read for file access (explicitly allowed for ~/.codex/AGENTS.md), and request_user_input for interacting with the user (SKILL.md, agents/openai.yaml).
- Sanitization: Not present; the skill treats content within the target files and referenced workflows as material to be audited and followed without explicit filtering for malicious payloads.
- [EXTERNAL_DOWNLOADS]: Fetches refactoring guidelines and model-specific documentation from established technology service domains.
- Source: Retrieves information from developers.openai.com regarding model behavior and refactoring criteria.
- Source: Accesses learn.chatgpt.com for documentation on agent configuration and precedence rules.
Audit Metadata