continue-codex-work

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s required workflow runs python3 scripts/extract_codex_resume.py, which reads and parses local Codex rollout JSONL / sqlite state from ~/.codex/sessions/.../rollout-*.jsonl and then injects the extracted user/assistant text into the produced “briefing” (LLM context), so the runtime free text originates from prior Codex session messages authored by parties other than the operating user (e.g., the assistant’s own outputs and any other participants in that session).