The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions direct the agent to "walk up CWD for .env" files to resolve environment variables. Accessing .env files is a high-risk pattern as they typically contain sensitive API keys, database credentials, and other secrets.
[CREDENTIALS_UNSAFE]: The skill processes the ~/.codex directory, which contains potentially sensitive session logs, configuration files (config.toml), and transcripts. While it includes instructions to redact credentials during distillation, the capability to read these files is an inherent risk.
[COMMAND_EXECUTION]: The skill performs multiple shell command executions for wiki maintenance and indexing. This includes running obsidian-wiki memory sync and the qmd CLI tool suite (qmd update, qmd embed, qmd ls, qmd get). The commands utilize environment variables like ${QMD_CLI:-qmd} and $QMD_WIKI_COLLECTION to determine execution paths and targets.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection by parsing external, potentially untrusted data from Codex session logs to generate wiki content.
Ingestion points: The skill reads ~/.codex/session_index.jsonl, ~/.codex/sessions/**/rollout-*.jsonl, and ~/.codex/history.jsonl (SKILL.md).
Boundary markers: There are no explicit delimiters or specific instructions to the agent to treat the content of these logs as untrusted data during the distillation process.
Capability inventory: The skill has permissions to read from the user's home directory (~/.codex), write Markdown files to the Obsidian vault, and execute shell commands (obsidian-wiki, qmd).
Sanitization: The instructions include a "Critical privacy filter" to remove API keys and secrets and advise the agent to summarize rather than quote verbatim, which provides limited protection against adversarial instructions embedded in logs.

codex-history-ingest