run-codex-bridge

Fail

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs users to download an installation script from the author's GitHub repository (github.com/yigitkonur/codex-worker) and provides a fallback installation method via the npm package registry.
  • [REMOTE_CODE_EXECUTION]: Installation steps include piping a remote shell script directly to bash or sudo bash, allowing for the execution of code hosted on a remote server.
  • [COMMAND_EXECUTION]: Instructions involve using sudo to obtain administrative permissions for global tool installation and executing various codex-worker subcommands to manage threads and turns.
  • [PROMPT_INJECTION]: The skill is designed to ingest and act upon content from markdown files (e.g., task.md), which constitutes an indirect prompt injection surface where untrusted data could influence the agent's actions. * Ingestion points: Markdown prompt files are read and processed by the CLI as described in SKILL.md and references/command-reference.md. * Boundary markers: There are no explicit markers or instructions to isolate or ignore potentially malicious content within the ingested files. * Capability inventory: The codex-worker CLI can modify files and execute commands within the workspace (documented in references/orchestration-patterns.md). * Sanitization: No sanitization or verification of the markdown file content is specified before execution.
Recommendations
  • HIGH: Downloads and executes remote code from: https://github.com/yigitkonur/codex-worker/releases/latest/download/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 22, 2026, 10:53 AM