The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python wrapper (scripts/codex_wrapper.py) to execute a local codex binary and discover the environment using the subprocess module. It also instructs the agent to perform manual environment discovery through shell commands like which codex and zsh -lic 'command -v codex; codex --version' to ensure the correct binary and shell context are used.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for the Codex agent, which processes local source code for refactoring and review tasks, creating a potential vector for malicious code to influence the agent's behavior.
Ingestion points: The skill reads local files and repository content through the review and exec commands (located in scripts/codex_wrapper.py).
Boundary markers: The wrapper utilizes the --json flag to return structured output, but the instructions do not specify explicit delimiters or "ignore instructions" warnings for the content being processed by the underlying Codex model.
Capability inventory: The skill possesses the capability to write to the workspace (via the workspace-write sandbox) and perform arbitrary code execution (via codex exec).
Sanitization: There is no evidence of pre-processing sanitization or filtering of the source code content before it is passed to the Codex CLI.
[DATA_EXPOSURE]: The skill manages sensitive OAuth credential files in ~/.codex/auth.json and session logs in ~/.codex/logs_*.sqlite. It provides extensive safety guidance in references/oauth-guide.md to prevent the exfiltration of these tokens, including instructions on how to perform secure credential transfers and avoid leaking secrets in command arguments or logs.

local-codex