The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md command the agent to fetch content from multiple untrusted domains (e.g., codex-reset.com, api.fxtwitter.com, hascodexratelimitreset.today) and pipe the output directly into python3. This allows remote actors to potentially execute arbitrary code if the retrieved data is malicious or if the pipe logic is bypassed.
[DATA_EXFILTRATION]: The script scripts/import-google-cookies.py is specifically designed to copy sensitive .google.com session cookies from the user's primary Chrome profile into a skill-controlled profile. Additionally, scripts/query_usage.py accesses ~/.codex/auth.json to retrieve access_token and account_id credentials for network requests.
[INDIRECT_PROMPT_INJECTION]: The skill is heavily reliant on processing untrusted data from external social media posts and community trackers. It explicitly instructs the agent to read the "full text" of these posts, creating a high-risk surface for indirect prompt injection where an attacker could embed malicious instructions in a tweet or status update to hijack the agent's behavior.
[COMMAND_EXECUTION]: Numerous scripts (forecast_log.py, import_google_cookies.py, scan_rollouts.py) use subprocess.run to execute shell commands. The skill also includes shell scripts like launch-usage-profile.sh that launch browser instances with specific data directories.
[CREDENTIALS_UNSAFE]: The skill logic involves reading and handling sensitive authentication tokens (access_token) and session cookies. While it includes warnings about privacy, the automated movement and handling of these secrets within the skill's infrastructure pose a significant risk of credential exposure.

tibo-reset-codex