The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to utilize an external CLI tool named codex for autonomous task execution. It explicitly recommends the use of the --full-auto flag for implementation, research, debugging, and shell tasks, which permits the tool to execute shell commands and git operations without direct human oversight for each step.- [REMOTE_CODE_EXECUTION]: By delegating work to the Codex sub-agent, the skill facilitates the dynamic generation and execution of code within the local environment. The primary agent initiates these processes through shell commands, handing control to the sub-agent's autonomous logic.- [PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect prompt injection through its log-handling protocol. The main agent is instructed to ingest and present logs generated by the sub-agent (e.g., from $env:TEMP\codex-output.txt).
Ingestion points: The agent reads output files from the sub-agent's execution, such as $env:TEMP\codex-output.txt and terminal logs (SKILL.md).
Boundary markers: Absent; while the skill suggests formatting logs in collapsible blocks, it lacks instructions for the agent to ignore or sanitize instructions that may be embedded within those logs.
Capability inventory: The Codex tool possesses autonomous shell and file-write capabilities, while the main agent maintains shell and file-read capabilities.
Sanitization: None; the skill instructs the agent to extract and display the logs without filtering or validation.- [DATA_EXFILTRATION]: The skill grants the sub-agent broad access to the workspace root (-C "<workspace_root>") and architectural context. The pattern of capturing sub-agent output into temporary files for later processing by the main agent increases the risk that sensitive codebase information or environment data could be exposed in log files.

codex-subagent