Skills
skills/alemar11/skills/codex-changelog/Gen Agent Trust Hub

codex-changelog

Pass

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/print_codex_changelog.py executes the command codex --version to identify the current software version. This is a static execution used for tool identification and does not process user-provided arguments.\n- [EXTERNAL_DOWNLOADS]: The skill fetches release information from the GitHub API (api.github.com) for the openai/codex repository. This communication is restricted to a well-known service and a trusted organization to provide changelog data.\n- [PROMPT_INJECTION]: The skill processes external text from GitHub releases which presents an indirect prompt injection surface.\n
  • Ingestion points: The body field of the GitHub release JSON in scripts/print_codex_changelog.py.\n
  • Boundary markers: None.\n
  • Capability inventory: Local command execution via subprocess.check_output in scripts/print_codex_changelog.py.\n
  • Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 6, 2026, 12:21 PM