codex-skill-admin
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to interact with the localcodexCLI. Specifically, it executescodex app-serverto manage skill configurations andcodex debug prompt-inputto verify skill visibility. These calls use argument lists rather than shell strings, which mitigates standard command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill scans local session logs (located in
~/.codex/sessions/and~/.codex/archived_sessions/) to identify which skills have been used recently. While these logs contain data generated during previous AI interactions, the script only applies regular expressions to identify file paths (SKILL.md) and does not execute the content of the logs, significantly limiting the risk of indirect injection. - [DATA_EXPOSURE_AND_EXFILTRATION]: The script reads local configuration and session data for auditing purposes. All network activity is restricted to the local loopback interface (
127.0.0.1) to communicate with a temporary Codex application server, with no evidence of data exfiltration to external domains.
Audit Metadata