The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions and documentation (in both SKILL.md and SKILL.toon) recommend using the --madmax flag, which is explicitly defined as mapping to the --dangerously-bypass-approvals-and-sandbox flag in the Codex CLI. This instruction directs the AI to ignore its standard safety protocols and execution restrictions.
[EXTERNAL_DOWNLOADS]: The skill requires the global installation of the oh-my-codex package via NPM. This dependency originates from a third-party repository (Yeachan-Heo/oh-my-codex) and executes with system-level permissions.
[DYNAMIC_EXECUTION]: The orchestration layer features a hook extension system that dynamically loads and executes Javascript modules (.mjs) from the .omx/hooks/ directory. This runtime execution of local plugins allows for arbitrary code execution during the session lifecycle.
[INDIRECT_PROMPT_INJECTION]: The skill serves as a multi-agent orchestration framework that processes untrusted user input across various specialized roles.
Ingestion points: User-provided task strings passed to commands like $autopilot, $plan, and $team in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate user-provided data from agent instructions.
Capability inventory: The skill uses powerful system tools including Bash for shell command execution and Write for modifying the filesystem.
Sanitization: There is no evidence of input validation or sanitization before user-supplied tasks are interpolated into the orchestration pipeline.
[COMMAND_EXECUTION]: The skill relies on the execution of the omx CLI tool for setup, diagnostics, and team orchestration, which in turn manages subprocesses and parallel workers in tmux.

omx