Trust Assessment
codex received a trust score of 48/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 1 critical, 1 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user prompt in `echo`, Explicit instruction to use `danger-full-access` sandbox mode, Instruction to always skip Git repository check.
The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. The static_code_analysis layer scored lowest at 48/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 0676c56a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via unsanitized user prompt in `echo` The skill instructs the agent to construct shell commands that pipe user-provided input via `echo` to `codex exec`. Specifically, `echo "your prompt here" | codex exec ...` and `echo "new prompt" | codex exec resume --last ...`. If the 'prompt' content is not rigorously sanitized to escape shell metacharacters, an attacker could inject arbitrary shell commands (e.g., `$(command)`, `;`, `&`) that would be executed on the host system before being passed to `codex exec`. User input intended for piping via `echo` must be strictly sanitized or escaped to prevent shell metacharacter interpretation. A safer approach would be to pass the prompt as a direct argument to `codex exec` if supported, or write the prompt to a temporary file and then pipe the file content, ensuring the file content is not interpreted as shell commands. | Unknown | SKILL.md:30 | |
| HIGH | Explicit instruction to use `danger-full-access` sandbox mode The skill explicitly instructs the agent to use the `--sandbox danger-full-access` flag, which is described as permitting 'network or broad access'. While the skill includes a mitigation requiring the agent to ask the user for permission before using high-impact flags, the capability itself is highly privileged. If the user is tricked or the agent misinterprets the user's intent, this mode could allow arbitrary network requests, file system access, or other broad operations, leading to data exfiltration, system compromise, or unauthorized actions. Re-evaluate the necessity of `danger-full-access`. If absolutely required, implement robust, multi-factor user confirmation and clear, explicit warnings about the risks. Consider if more granular permissions or a more restricted sandbox mode could achieve the desired functionality. Implement strict logging and auditing for any actions performed under this mode. | Unknown | SKILL.md:23 | |
| MEDIUM | Instruction to always skip Git repository check The skill explicitly instructs the agent to 'Always use --skip-git-repo-check'. This flag bypasses a safety mechanism in the `codex` tool that likely prevents operations on non-Git repositories or untracked changes. Bypassing this check globally could lead to unintended modifications, data loss, or execution of `codex` in an environment where its assumptions about version control are violated, potentially causing unexpected behavior or security issues. Remove the instruction to 'Always use --skip-git-repo-check'. The agent should only use this flag if explicitly requested by the user, if the task context genuinely requires it (e.g., working in a non-Git managed directory), and the implications are clearly communicated and understood by the user. | Unknown | SKILL.md:15 |
Scan History
Embed Code
[](https://skillshield.io/report/49b1f24d0022639b)
Powered by SkillShield