The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external command-line tools, specifically the OpenAI Codex CLI (codex) and Git (git), to perform coding tasks and inspect the repository state. This is the primary intended function of the skill.
[INDIRECT_PROMPT_INJECTION]: The implementation process involves the Codex tool reading files from the target repository. This creates a surface for indirect prompt injection if the repository contains malicious instructions designed to subvert the implementer's behavior or exfiltrate data. The skill documentation explicitly acknowledges this risk, particularly when network access is enabled for the implementer.
Ingestion points: Files within the repository processed by the codex CLI (e.g., source code, documentation).
Boundary markers: The skill recommends using structured briefs with XML tags to delimit instructions and provide explicit scope constraints.
Capability inventory: The skill can modify repository files and optionally access the network via the Codex CLI.
Sanitization: The skill does not sanitize repository content; instead, it enforces a human-in-the-loop review process where the orchestrating agent must verify all changes before committing.
[DYNAMIC_EXECUTION]: The relay.mjs script dynamically constructs shell commands to interact with the Codex CLI. It utilizes strict regular expression validation to ensure that parameters such as model names, session IDs, and reasoning effort tokens are shell-safe and free of malicious characters, particularly when executing with shell: true on Windows platforms.

codex-delegate