The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/tmux_run_codex_task.sh invokes worker agents using the codex exec command with the --dangerously-bypass-approvals-and-sandbox flag. This configuration explicitly disables all security guardrails, including the execution sandbox and user approval for sensitive operations, allowing the sub-agent to execute any shell command on the host system.
[DYNAMIC_EXECUTION]: The skill dynamically generates prompt files for each task at $RUN_ROOT/prompts/<TASK_ID>.md based on a user-provided plan. These generated scripts are then executed via the unsandboxed codex command, meaning that any code or commands produced during the task execution are run with the full privileges of the host user.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of external plan files without proper isolation.
Ingestion points: The skill reads and parses a task plan from a local plan.md file as described in the Plan Parsing section of SKILL.md.
Boundary markers: The instructions do not define clear boundaries or use delimiters to prevent the sub-agent from following instructions embedded within the plan data.
Capability inventory: The worker agents have full system access via codex exec without sandboxing, as seen in scripts/tmux_run_codex_task.sh.
Sanitization: No sanitization is performed on the plan content before it is interpolated into the worker prompts.

parallel-task-tmux