The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx --yes great-cto@3.62.0 to download and execute an external package from the npm registry. While version pinning is used to mitigate supply chain risks, it introduces a dependency on third-party code.
[COMMAND_EXECUTION]: The skill executes multiple subcommands via Bash, including doctor, list, start, and approve. These commands have the capability to interact with the project filesystem, Docker, and the GitHub CLI.
[INDIRECT_PROMPT_INJECTION]: The start command template includes a --prompt argument that interpolates user-provided text directly into the shell command.
Ingestion points: The --prompt flag in the codex-host start command within SKILL.md.
Boundary markers: The command template uses double quotes ("the requested outcome") to wrap the user input, but the instructions do not specify a requirement for the agent to sanitize or escape shell-sensitive characters such as backticks, semicolons, or subshell syntax.
Capability inventory: The skill is configured with Read and Bash tools. It specifies write boundaries via the --allow flag and can perform actions through external adapters like GitHub or local project directories.
Sanitization: No explicit input validation, sanitization, or filtering logic for the user-supplied prompt is described in the skill instructions.

codex-host