The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/codex_wrapper.py script uses the subprocess module to invoke the local codex CLI binary. These calls are used to check authentication status, run code reviews, and execute coding tasks. The script searches for the binary in standard locations such as /Applications/Codex.app, /usr/local/bin, and user-specific npm directories.
[CREDENTIALS_UNSAFE]: The skill manages sensitive authentication data stored in ~/.codex/auth.json. This file contains OAuth tokens for a ChatGPT Pro subscription. While the skill does not exfiltrate these credentials, it provides instructions on their location and management, which is a standard requirement for the tool's functionality.
[PROMPT_INJECTION]: The skill acts as a bridge to a local Codex agent, which creates a surface for indirect prompt injection where instructions in the processed data could influence the agent's behavior.
Ingestion points: The prompt and workdir parameters in scripts/codex_wrapper.py receive external input that is passed directly to the CLI.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are applied to the input before it is passed to the underlying agent.
Capability inventory: The codex exec command can perform file system operations (e.g., workspace-write sandbox) and, if explicitly configured, full system access (danger-full-access).
Sanitization: The wrapper script does not perform validation or sanitization of the input prompt, relying instead on the underlying CLI's own safety mechanisms.

local-codex