The Agent Skills Directory

[COMMAND_EXECUTION]: The relay.mjs script (scripts/relay.mjs) executes the codex and git binaries. It uses strict regular expression validation for sensitive command-line arguments, such as --model and --session tokens, to prevent shell injection attacks. This is particularly important on Windows where the script uses shell-based execution to resolve NPM command shims.
[DYNAMIC_EXECUTION]: The skill facilitates the modification of source code by an AI implementer. This inherent risk is mitigated by the skill's mandatory review protocol and the use of the workspace-write or read-only sandbox modes provided by the Codex CLI. The orchestrating agent is instructed to treat the implementer's work as a draft that requires verification.
[INDIRECT_PROMPT_INJECTION]: The skill processes external task briefs and AI-generated output. 1. Ingestion points: Instructions enter the system via the brief file or stdin passed to relay.mjs. 2. Boundary markers: The skill documentation (references/writing-the-brief.md) recommends using structured XML tags to clearly delimit instructions. 3. Capability inventory: The implementer has the ability to modify project files and trigger build or test commands as specified in the brief. 4. Sanitization: The skill mandates a thorough review process where the orchestrator must manually check the git diff for scope creep or 'gate gaming' (e.g., deleted or weakened tests) before committing any code.
[SAFE]: The skill provides a --clean-env flag to isolate the implementation process from the host's environment variables. This prevents the accidental exposure of sensitive credentials (like SSH keys or AWS tokens) to the implementer unless they are explicitly whitelisted via the --keep-env flag.

codex-delegate