The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the use of the codex CLI, which can execute shell commands and modify files. It includes high-privilege options such as --yolo (bypassing all approvals) and --sandbox danger-full-access (granting full machine access).
[DYNAMIC_EXECUTION]: The skill suggests enabling shell completions using the eval "$(codex completion zsh)" pattern, which executes the command's output directly in the shell.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes external codebases and instructs the agent to summarize the results, creating a surface for indirect prompt injection from malicious repository content.\n
Ingestion points: The agent processes output from codex exec commands, which involves reading and analyzing project files (SKILL.md).\n
Boundary markers: The instructions lack specific delimiters or warnings to ignore instructions embedded within the analyzed data (SKILL.md).\n
Capability inventory: The codex tool possesses file-writing and shell execution capabilities (SKILL.md).\n
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from analyzed repositories before it is summarized (SKILL.md).
[PERSISTENCE]: The documentation encourages users to add completion commands to their shell profile (e.g., ~/.zshrc), which is a persistence mechanism.

codex