codex-skill-admin
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.Popenandsubprocess.runto interact with thecodexcommand-line utility. These calls are used to start a temporary local application server for API access and to run debug commands for verifying skill visibility. The execution is handled safely using list-based arguments to prevent shell injection. - [DATA_EXPOSURE]: To perform usage audits, the script reads local Codex session logs and history files located in the user's home directory. This is a legitimate function of the skill's stated purpose to identify which skills have been recently used by the agent, and the data is processed locally without external transmission.
Audit Metadata