The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute the codex CLI tool with user-provided arguments. Notably, it suggests piping user prompts directly into a shell command (e.g., echo "your prompt here" | codex exec resume --last). Without specific instructions for shell escaping or sanitization, this pattern creates a risk where malicious user input could include shell metacharacters to execute unauthorized commands on the host system.
[PRIVILEGE_ESCALATION]: The skill documentation encourages the use of high-privilege flags like --sandbox danger-full-access and --skip-git-repo-check. The danger-full-access mode explicitly grants the tool network and broad system access, which are significant privileges that bypass default safety sandboxes.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where untrusted data (user prompts) is fed into a powerful execution environment.
Ingestion points: The agent collects user input for model parameters and task prompts to be used in the codex command pipeline (described in skill.md).
Boundary markers: The instructions do not specify any boundary markers or delimiters to protect the execution context from malicious instructions embedded within the user's data.
Capability inventory: The skill has access to subprocess execution via codex exec, with functional capabilities for file modification and network communication.
Sanitization: No technical sanitization or validation of the user-provided prompt is performed before it is passed to the shell.

codex