The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection in SKILL.md to execute a shell command at load time: !grep -E '^(model|model_reasoning_effort)' ~/.codex/config.toml 2>/dev/null || .... This allows the agent to automatically read content from the user's home directory (~/.codex/config.toml) without explicit per-action consent.
[EXTERNAL_DOWNLOADS]: The skill documentation indicates that the scripts/codex wrapper automatically installs a CLI tool via npx upon first use. This pattern facilitates the download and execution of external packages from the npm registry, which are not bundled with the skill itself.
[COMMAND_EXECUTION]: The skill provides instructions for executing a local wrapper script via the Bash tool. The instructions include complex shell patterns such as process substitution, redirection, and process termination (pkill). It also mentions a sandbox bypass flag (-s danger-full-access) available in the underlying tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts as its primary input. While it includes defensive instructions to mitigate shell injection by writing input to temporary files and using stdin redirection, the ingestion of untrusted data remains a vulnerability surface.
Ingestion points: The <prompt> argument defined in the skill metadata is used to pass instructions to the external CLI.
Boundary markers: The instructions recommend using the Write tool to place prompts in a temporary file and then using the Bash tool to redirect that file to stdin (< /tmp/codex-prompt.md) to avoid direct shell interpolation.
Capability inventory: The skill has access to Bash, Read, and Write tools, which allows for file manipulation and arbitrary command execution.
Sanitization: The skill does not perform explicit sanitization of the input, instead relying on the shell's redirection mechanism to prevent control character execution.

codex