run-codex-review-loop
Warn
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands dynamically, including
gitandcodex. It interpolates user-supplied 'focus text' into lens prompts which are then executed via the command line:codex exec review ... "<lens prompt>". Additionally, it executes a Node.js script using a variable-based path:node "<codex-plugin>/scripts/codex-companion.mjs". - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) because it reads and processes the entire repository being reviewed, along with outputs from multiple exploration agents.
- Ingestion points: Repository source code, documentation (AGENTS.md, CLAUDE.md), and intermediate analysis reports from exploration agents.
- Boundary markers: The instructions do not define specific delimiters or security warnings to prevent the agent from executing instructions found within the code or documentation.
- Capability inventory: The agent can execute various shell commands (
git,codex,node) and write files to the/tmpdirectory. - Sanitization: There is no explicit requirement to sanitize or validate the content of the repository before using it to generate review reports or subsequent analysis rounds.
- [COMMAND_EXECUTION]: The exploration phase specifically directs agents to identify 'credential paths' and 'external systems'. While intended for security auditing, this involves the automated discovery of sensitive information locations within the project environment.
Audit Metadata