The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash and python3 to execute a local workflow that invokes the codex CLI. This is the primary mechanism for generating images and is performed using standard subprocess execution methods without shell injection vulnerabilities.
[DATA_EXPOSURE]: The skill accesses local session files located in ~/.codex/sessions/ to retrieve generated image data. Access is specifically restricted to files matching the thread_id of the current invocation to prevent unauthorized access to unrelated session history.
[INDIRECT_PROMPT_INJECTION]: User-provided prompts are passed directly to the image generation tool. The skill instructs the agent to pass these prompts raw and includes specific requirements for the underlying model to handle refusals without silently rewriting instructions. This ingestion of untrusted data represents a standard attack surface for prompt injection, though mitigated by model-level controls and the skill's own logic.
[SAFE_PRACTICE]: The extract_image.py script implements validate_output_path, which restricts file writing to allowed image extensions (.png, .jpg, .webp, etc.) and explicitly forbids writing to system directories, protecting the integrity of the host filesystem.

gpt-image-2