The Agent Skills Directory

[PERSISTENCE]: The skill establishes persistence by creating and configuring hooks in ~/.codex/hooks.json or <repo>/.codex/hooks.json. These hooks are designed to trigger on future events such as SessionStart, UserPromptSubmit, and PreToolUse, ensuring that custom logic persists across agent restarts.
[DYNAMIC_EXECUTION]: The skill generates and writes scripts to ~/.codex/hooks/ or <repo>/.codex/hooks/ which are intended for runtime execution by the platform's hook system. This mechanism allows the agent to create and deploy dynamically generated executable code based on user descriptions.
[COMMAND_EXECUTION]: The workflow includes a verification step that requires running shell commands to trigger and confirm the behavior of the newly created hooks, providing a path for arbitrary command execution during the setup process.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect instruction injection because it ingests unstructured user intent to generate executable scripts.
Ingestion points: User-provided descriptions of hook behavior in SKILL.md (Workflow step 3).
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from following malicious commands embedded within the user's behavior description.
Capability inventory: The skill utilizes file system write capabilities for script and configuration deployment and shell execution for hook verification as documented in SKILL.md.
Sanitization: There is no evidence of sanitization, validation, or escaping of the user-provided input before it is written into executable hook scripts.

create-hook