The Agent Skills Directory

[METADATA_POISONING]: The skill description and purpose claim to provide "Zero Data Retention" and ensure that "no code is stored on OpenAI servers." These are safety-critical claims that an agent skill cannot technically guarantee, as data retention is managed by the service provider's API and platform settings, not by agent instructions. This deception could lead users to process sensitive proprietary or regulated data (medical, financial) in an unsafe manner.
[DATA_EXFILTRATION]: The "LIBRARY-FIRST PROTOCOL" instructs the agent to scan D:\Projects\* to extract and adapt existing code. This grants the agent broad access to the user's entire local project directory on the D: drive, which likely contains sensitive intellectual property.
[COMMAND_EXECUTION]: The skill instructs the use of a local shell script scripts/multi-model/codex-yolo.sh. The contents and safety of this script are not defined in the skill, posing a risk of arbitrary command execution when the agent attempts to fulfill the task.
[INDIRECT_PROMPT_INJECTION]: The protocol to read from and adapt code in D:\Projects\* creates a vulnerability surface. If an attacker can place a file in the projects directory with embedded malicious instructions, the agent will ingest and potentially execute them during its scan.
Ingestion points: Local file system access to D:\Projects\* defined in SKILL.md.
Boundary markers: Absent. No instructions are provided to the agent to treat external project code as untrusted.
Capability inventory: The skill has access to Bash, Read, Write, and TodoWrite tools, and references a codex-yolo.sh script.
Sanitization: Absent. No validation or filtering is performed on the ingested code snippets.

codex-zdr