The Agent Skills Directory

[COMMAND_EXECUTION]: Instructions in references/dispatch.md explicitly direct the user to employ the --dangerously-bypass-approvals-and-sandbox flag with the codex CLI. This flag intentionally disables security boundaries and eliminates user approval steps for code execution.
[REMOTE_CODE_EXECUTION]: The orchestration logic in references/dispatch.md uses the codex exec command to execute code generated by a remote large language model. When combined with sandbox bypass flags, this enables the execution of unverified remote instructions with full access to the local environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as documented in references/dispatch.md.
Ingestion points: Untrusted data enters the agent context from prompt_tpl.txt and JSON files within the slices/ directory.
Boundary markers: There are no delimiters or explicit instructions provided to the agent to ignore potentially malicious commands embedded in the processed data.
Capability inventory: The skill has access to shell execution via codex exec and provides methods for managing remote GPU environments via SSH in references/remote-gpu-ssh.md.
Sanitization: No validation or sanitization of the input data is performed before it is interpolated into prompts using shell string substitution.
[DATA_EXFILTRATION]: While the skill advises returning only 'thin' files from remote environments, the combination of SSH access, full directory isolation, and automated dispatching creates a significant surface for unauthorized data movement between local and remote systems.

orchestrating-parallel-research