openai-docs

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads markdown documentation and metadata from developers.openai.com. This includes the official Codex manual and latest model selection guides.
  • [COMMAND_EXECUTION]: The skill executes local Node.js utility scripts to process the downloaded documentation.
  • scripts/fetch-codex-manual.mjs: Uses curl or fetch to retrieve the Codex manual and generate an outline.
  • scripts/resolve-latest-model-info.js: Fetches and parses model metadata to provide up-to-date migration guidance.
  • The skill also provides instructions for the agent to install an MCP server using the codex mcp add command.
  • [DATA_EXFILTRATION]: The skill writes documentation to local temporary cache directories such as /tmp/openai-docs-cache or %TEMP%\openai-docs-cache. This is used for performance optimization and offline access during the session.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from developers.openai.com which is then used to influence the agent's responses and guidance. While these are official sources, this represents a standard indirect injection surface for documentation-based skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 12:31 PM
Security Audit — agent-trust-hub — openai-docs