The Agent Skills Directory

[COMMAND_EXECUTION]: The test script scripts/test_codex_session.py uses subprocess.run() to execute the parser script. This is restricted to local testing purposes, avoids shell invocation, and uses a hardcoded argument structure.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data, presenting a potential injection surface.
Ingestion points: Data is read from local JSONL rollout files by scripts/codex-session.py.
Boundary markers: Explicit instructions in SKILL.md tell the agent to treat content as data, not instructions. The script also filters known injected prefixes (INJECTED_PREFIXES).
Capability inventory: The script is limited to reading and rendering text; it lacks network access or file-writing capabilities.
Sanitization: Content is truncated via the --max-chars parameter and system tags are stripped before rendering.
[SAFE]: The skill implements robust input validation. The session_id is verified against a strict UUID regular expression, and file discovery is limited to specific subdirectories within the Codex home directory using a fixed filename pattern, effectively preventing path traversal or unauthorized file access.

codex-session