The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The SKILL.md file explicitly instructs the agent to automatically retry installation commands with escalated permissions if an initial attempt fails due to sandboxing or permission constraints. This encourages the agent to bypass security boundaries without direct user initiation.
[METADATA_POISONING]: The skill body and referenced files (references/latest-model.md, references/upgrading-to-gpt-5p4.md) provide extensive, authoritative-sounding documentation for non-existent software and models, such as GPT-5.4, Sora-2, and GPT-5-mini. Providing fabricated technical guidance is deceptive and can lead users or agents to perform incorrect or unsafe actions based on false premises.
[COMMAND_EXECUTION]: The instructions include directives to execute shell commands (codex mcp add) to modify the agent's operating environment by installing third-party tools.
[INDIRECT_PROMPT_INJECTION]: The 'Upgrade Workflow' described in the reference files requires the agent to ingest user-provided code, prompt templates, and configuration files to perform automated modifications. This processing of untrusted external data creates a surface for instructions embedded in that data to influence the agent's behavior.
[EXTERNAL_DOWNLOADS]: The skill initiates the download and installation of an MCP server from OpenAI's developer domain. While targeting a well-known service, the automated installation process via command-line tools increases the risk profile of the skill.

openai-docs