The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides specific templates (gpt5.4-unrestricted.md and gpt5.5-unrestricted.md) and user interface features designed to bypass safety filters and enable "unrestricted mode" in the Codex CLI.
[CREDENTIALS_UNSAFE]: The skill facilitates reading and writing to sensitive files, specifically ~/.codex/auth.json, which contains API keys and authentication tokens, and ~/.codex/sqlite/*.db session databases.
[EXTERNAL_DOWNLOADS]: Directs users to download pre-built binaries and clone source code from a GitHub repository (github.com/yynxxxxx/Codex-X) that is not associated with the stated author's organization ('Aradotso').
[COMMAND_EXECUTION]: Explicitly instructs users to run commands to bypass macOS Gatekeeper security controls by removing the quarantine attribute (xattr -dr com.apple.quarantine) from downloaded applications.
[REMOTE_CODE_EXECUTION]: Provides instructions to clone, install dependencies, and build a desktop application from an external untrusted source, leading to the execution of code on the local machine.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by processing external configuration and session data with significant capabilities but without clear boundary markers or sanitization.
Ingestion points: Processes ~/.codex/config.toml, ~/.codex/auth.json, and SQLite session databases.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions within these data sources.
Capability inventory: Includes file system read/write access (fs::write, fs::read), SQLite database modification (rusqlite), and shell execution for building applications.
Sanitization: No evidence of sanitization or filtering for external content beyond basic TOML/JSON syntax validation.

codex-x-desktop-manager