x9-codex-delegation
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
codexCLI and several POSIX shell utilities (mktemp,chmod,umask,trap,git) to manage the lifecycle of delegation prompts and verify project state. - [INDIRECT_PROMPT_INJECTION]: The skill ingests codebase content and user instructions to pass to an external executor, creating a surface for indirect prompt injection if malicious content exists in the processed files.
- Ingestion points: The skill reads project files and user briefs to populate a temporary transport file (
DELEGATION_PROMPT_FILE) defined inreferences/codex-cli.md. - Boundary markers: Instructions recommend the use of
--disable hooksand--ephemeralflags to isolate the execution context. - Capability inventory: The skill uses subprocess calls to
codexand local shell commands; it writes logs to~/.local/share/x9/and temporary files to/tmp. - Sanitization: The skill employs strict security hardening for data transport, including
umask 077andchmod 600for temporary files, and passes prompts viastdinto prevent shell injection.
Audit Metadata