The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/write_role_config.sh script is vulnerable to a filter injection attack. The script concatenates user-supplied input from the --mcp-enable and --mcp-disable arguments directly into a tomlq (jq-style) expression string. A malicious user could provide a crafted string, such as name"] | .sandbox_mode = "danger-full-access" | .mcp_servers["dummy, which would effectively inject arbitrary TOML configuration keys into the resulting file, potentially disabling sandboxing or adding malicious external services.
[CREDENTIALS_UNSAFE]: The skill includes functionality in scripts/write_role_config.sh to read the contents of a local file via the --developer-instructions-file flag and embed that content into a configuration file. If an attacker successfully tricks the agent into reading a sensitive file like ~/.ssh/id_rsa or a .env file, the contents would be exposed and potentially exfiltrated through the generated configuration.
[INDIRECT_PROMPT_INJECTION]: The skill manages and writes configuration files that control the behavior of other agents, representing a significant attack surface for indirect prompt injection.
Ingestion points: User-provided inputs for role names, descriptions, and developer instructions as seen in the SKILL.md workflows.
Boundary markers: None. The scripts perform direct shell-based string manipulations and command executions without isolating user-provided data.
Capability inventory: The skill can create directories (mkdir -p), write new files, and modify the core Codex configuration file (~/.codex/config.toml).
Sanitization: There is no evidence of input validation or sanitization to prevent control characters from influencing the command strings used by tomlq or the shell environment.

role-creator