The Agent Skills Directory

[DATA_EXPOSURE]: The 'LIBRARY-FIRST PROTOCOL' explicitly instructs the agent to access and extract data from a broad local path: D:\Projects\*. This wide-scoped absolute path allows the agent to search across multiple unrelated projects on the host system, potentially exposing sensitive source code, configuration files, or credentials stored within the projects directory.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to audit and debug code from directories like src/ and tests/. This ingestion of untrusted external content creates a vulnerability surface where malicious instructions embedded in the code being audited could influence the agent's behavior.
Ingestion points: The agent reads content from src/, tests/, and the D:\Projects\* path for analysis.
Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions in the audited data are provided.
Capability inventory: The skill possesses Bash and Write capabilities, and executes an autonomous audit script (codex-audit.sh) that can perform iterative 'test-fix-retest' loops.
Sanitization: No evidence of sanitization or filtering of the ingested code content before processing.
[COMMAND_EXECUTION]: The skill uses a local shell script scripts/multi-model/codex-audit.sh to perform its tasks. The script accepts arbitrary task strings as arguments, which are executed autonomously. While the skill claims to use sandboxing (macOS Seatbelt/Docker), the reliance on shell execution for user-defined tasks remains a point of concern if sandbox configurations are bypassed or insufficient.

codex-audit