codex-external-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/codex_external_handoff.pyusessubprocess.Popento launch the localcodex app-serverand start background worker processes for task supervision. This is the intended behavior for delegating tasks to a persistent local environment.\n- [PROMPT_INJECTION]: The skill processes task instructions from external files via the--task-fileargument, which introduces a potential surface for indirect prompt injection.\n - Ingestion points: The
launch_jobfunction inscripts/codex_external_handoff.pyreads user-provided task content from the file system.\n - Boundary markers: Task data is structured as JSON for transport, but no explicit markers or safety instructions are added to the task text itself to prevent the agent from obeying instructions embedded within the data.\n
- Capability inventory: The skill can execute local commands (
codex, Python worker) and perform file operations within the~/.codexdirectory.\n - Sanitization: No sanitization or content validation is applied to the data ingested from task files.\n- [SAFE]: Sensitive task data is passed to background workers via temporary files that are deleted immediately after reading, rather than through command-line arguments. This prevents task content from being exposed in system process listings.
Audit Metadata