Codex documentation and model-facing instructions recommend unsafe prefix rules as examples of safe ones

What is the type of issue?

Documentation is incorrect

What is the issue?

The Codex auto-review documentation recommends,

Add narrowly scoped prefix rules. Prefer precise command prefixes such as ["cargo", "test"] or ["pnpm", "run", "lint"] over broad patterns such as ["python"] or ["curl"].

cargo test is not in any meaningful sense safer or more narrowly-scoped than python if the agent has write access to the workspace. Rust test suites may execute arbitrary code. Assuming a default :workspace-write permission setting, the agent can put whatever it wants into the test suite without requiring escalation. cargo test will execute that suite.

The same bad recommendation appears in the model-facing escalation-request instructions which provide guidance on what prefix rule to suggest for a persistent approval. They mention ["npm", "run", "dev"] and ["cargo", "test"] as good examples.

A similar error is present in the OpenAI-authored code-change-verification skill which tells the agent to ask for a persistent prefix-rule authorization that executes a repository-owned shell script, and in the curated cloudflare-deploy skill which suggests an ["npm", "run", "deploy"] escalation.

Where did you find it?

• Auto-review documentation: https://learn.chatgpt.com/docs/sandboxing/auto-review
• Escalation-request instructions: https://github.com/openai/codex/blob/ba2b67f9cda954bcdda43c2a65ac58e807b996bd/codex-rs/prompts/templates/permissions/approval_policy/on_request.md
• Code change verification skill: https://github.com/openai/openai-agents-python/blob/main/.agents/skills/code-change-verification/SKILL.md
• Cloudflare deploy skill: https://github.com/openai/skills/blob/main/skills/.curated/cloudflare-deploy/SKILL.md

Start by comparing the auto-review documentation with codex-rs/prompts/templates/permissions/approval_policy/on_request.md, then inspect the referenced SKILL.md files in openai-agents-python and openai/skills. Trace how each prefix-rule example is presented and update the affected documentation and model-facing guidance so the examples do not imply repository-owned commands are inherently safe. Done means the identified sources consistently describe the relevant safety limitation.