The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute arbitrary code and commands in various environments (Desktop, Remote/devbox, and Cloud Containers) using the cloud_threads.create tool. This is the primary functionality of the skill for performing engineering tasks like fixing bugs and running tests.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including pull request (PR) descriptions, comments, and repository source code. These inputs are used to formulate prompts for child tasks that possess significant execution capabilities.
Ingestion points: Reads codebases, PR statuses, PR comments, and repository-scoped skills (.agents/skills).
Boundary markers: The instructions recommend using human-readable prompts for child threads but do not specify technical boundary markers or 'ignore' instructions for untrusted data processed from repositories.
Capability inventory: The agent can create tasks with full shell/code execution access (cloud_threads.create), perform file system operations, and interact with external connectors (GitHub).
Sanitization: There are no instructions for sanitizing or escaping content retrieved from external PR comments or source code before passing it to the execution environment.
[DATA_EXFILTRATION]: The skill is instructed to access and read 'Local Codex memories' located in sensitive user directories such as ~/.codex/memories_v2/ or ~/.codex/memories/ on the desktop. While this is part of the platform's contextual design, it involves accessing historical interaction data and user preferences.

software-engineering