The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the hidden user directory ~/.codex/sessions/, which contains private conversation history, user prompts, and previous session data from the Codex tool. The extraction logic snapshots this directory and reads the contents of all new rollout files to search for image payloads, exposing sensitive personal data to the skill's scripts.
[COMMAND_EXECUTION]: The skill executes external CLI tools to perform its functions, specifically invoking the codex command-line utility.
Evidence: scripts/gen.sh runs codex exec with various parameters to generate images.
[PROMPT_INJECTION]: The skill includes a file named skill-report.json that contains a self-generated security audit and risk assessment. This is categorized as self-referential content (Category 8e) designed to provide authoritative claims about the skill's own safety to automated scanners.
Ingestion points: skill-report.json metadata.
Boundary markers: Absent.
Capability inventory: Shell command execution via codex; filesystem read/write.
Sanitization: The extract_image.py script validates output extensions and prevents writing to system-critical directories.
[EXTERNAL_DOWNLOADS]: The skill directs users to external resources for tool installation and references third-party hosted services.
Evidence: SKILL.md contains links to runcomfy.com and provides instructions to install the codex CLI via Homebrew.

gpt-image-2