The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to construct and execute shell commands using patterns like echo "[Content]" | codex exec. Because the content includes agent-generated plans and implementation summaries which are influenced by user input, this creates a risk of command injection if the strings contain shell metacharacters (e.g., semicolons, backticks, or command substitution).
[PROMPT_INJECTION]: The skill consistently includes the --force flag in cursor-agent commands. This practice systematically bypasses standard safety prompts or user confirmation steps during code implementation and modification, increasing the risk of unintended or destructive automated actions.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent feedback loop where the output of one agent (Cursor) is processed as input by others (Codex and Claude). This creates an attack surface where maliciously crafted code or comments could contain hidden instructions designed to manipulate the behavior of the reviewing agents.
Ingestion points: Reads code implemented by cursor-agent and feedback from codex exec (referenced in Phase 5 and Phase 6 of SKILL.md).
Boundary markers: None identified in the prompt templates to distinguish between data and instructions.
Capability inventory: Subprocess execution via codex exec and cursor-agent, and file reading via the Read tool.
Sanitization: No evidence of escaping or sanitizing content before piping it into shell commands.

codex-claude-cursor-loop