The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions include a preflight check that accesses ~/.codex/auth.json. This is a sensitive credential file likely containing authentication tokens for the Codex service. Accessing such files in the user's home directory exposes sensitive data to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the repository which can influence worker behavior:
Ingestion points: Reads AGENTS.md, CLAUDE.md, and other project documentation from the workspace.
Boundary markers: The skill does not employ delimiters or specific instructions to ensure the subagents ignore instructions or malicious content embedded within the gathered documentation.
Capability inventory: Workers launched via codex exec are granted workspace-write capabilities, allowing them to modify files and execute commands within the environment.
Sanitization: There is no evidence of validation or sanitization being applied to the content of the ingested files before they are included in worker briefs.
[COMMAND_EXECUTION]: The orchestrator executes multiple shell commands to manage environment state, including git worktree for repo isolation, grep for configuration verification, and timeout to manage execution windows.
[PRIVILEGE_ESCALATION]: The skill checks for the approvals_reviewer = "auto_review" setting in ~/.codex/config.toml. This configuration allows subagents to execute potentially dangerous operations without manual user approval, effectively bypassing default sandbox constraints and manual oversight.
[DYNAMIC_EXECUTION]: The skill dynamically constructs instruction files (briefs) and executes them using codex exec. It also manages persistent sessions through the use of thread identifiers and session resumption commands.

sol