The Agent Skills Directory

[DATA_EXFILTRATION]: The 'LIBRARY-FIRST PROTOCOL' section contains mandatory instructions for the agent to scan 'D:\Projects*' to find and extract existing code. This represents a significant risk of unauthorized data access and exposure of sensitive information stored outside the current workspace, directly violating the 'CWD only' isolation claim made in the same file.
[METADATA_POISONING]: The skill provides conflicting information regarding its security boundaries. The 'Isolation Layers' section claims filesystem access is restricted to the current working directory ('CWD only'), yet the mandatory 'Step 3' of the Library Protocol explicitly requires scanning the 'D:' drive. This deceptive instruction could lead users to believe the skill is safer and more isolated than it actually is.
[COMMAND_EXECUTION]: The skill relies on an external script located at 'scripts/multi-model/codex-yolo.sh' for its core functionality. The use of 'yolo' in the filename, combined with the '--full-auto' flag in CLI examples, suggests a design pattern that may bypass standard confirmation steps or safety checks during execution.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to process and experiment with 'untrusted or risky code,' which serves as a major ingestion point for malicious instructions.
Ingestion points: Untrusted source code, experimental dependencies, and external project files.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the sandboxed code as untrusted data or to ignore instructions embedded within that code.
Capability inventory: The skill allows access to powerful tools including 'Bash', 'Write', and 'Read'.
Sanitization: The instructions lack any requirement for sanitizing, escaping, or validating the untrusted code before the agent processes or executes it.

codex-sandbox