The Agent Skills Directory

[COMMAND_EXECUTION]: The skill functions by executing the codex CLI with user-supplied prompts and configuration flags.
Instructions mandate appending 2>/dev/null to all execution commands. This suppresses the standard error stream, potentially concealing security warnings, tool errors, or diagnostic messages from both the agent and the user.
The recommended shell piping pattern for resuming sessions (echo "prompt" | codex exec ...) represents a potential command injection surface if the agent fails to properly escape user-supplied content before execution.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest and analyze repository content, creating an attack surface for indirect prompt injection.
Ingestion points: Files within the local repository are read and analyzed by the codex exec command as described in SKILL.md.
Capability inventory: The skill can perform filesystem writes (--sandbox workspace-write) and request broad system access (--sandbox danger-full-access).
Boundary markers: The instructions lack explicit delimiters or warnings to treat ingested codebase content as untrusted data.
Sanitization: No sanitization or filtering logic is provided for the data read from the repository.
[METADATA_POISONING]: The skill contains deceptive claims regarding its capabilities and underlying technology.
It references non-existent models such as "GPT-5.2" and "GPT-5.2-max" and provides unverifiable performance metrics (e.g., "76.3% SWE-bench") which may mislead users about the skill's actual safety and effectiveness.
[EXTERNAL_DOWNLOADS]: The README provides installation instructions that involve downloading code from an external source.
The installation workflow fetches the skill source from the skills-directory GitHub organization.
[PRIVILEGE_ESCALATION]: The skill facilitates the use of high-impact execution modes.
It documents the use of flags like --sandbox danger-full-access and --full-auto, which significantly increase the agent's permissions. However, it mitigates this by instructing the agent to use AskUserQuestion to obtain permission before using these specific flags.

codex