The Agent Skills Directory

[COMMAND_EXECUTION]: The "Manual fallback" section in SKILL.md provides a shell command template (printf '... <prompt>' | codex exec ...) that is inherently unsafe. Because it uses single quotes to wrap a placeholder (<prompt>) intended for user-supplied text, an attacker could provide a prompt containing a closing single quote and shell metacharacters (e.g., '; touch /tmp/pwned; #) to execute arbitrary commands on the host system if the agent follows the instruction without manual escaping.
[INDIRECT_PROMPT_INJECTION]: The helper script scripts/codex-image.ts is vulnerable to prompt injection because it interpolates untrusted user input directly into the session's instruction block without adequate sanitization or boundary markers.
Ingestion points: User-provided text supplied via the --prompt argument or piped to stdin of scripts/codex-image.ts.
Boundary markers: The script uses a simple PROMPT: header but lacks any closing delimiters or escaping mechanisms to prevent the user input from breaking out of its intended context and influencing the agent's behavior.
Capability inventory: The skill can execute shell commands via the codex CLI and has broad file system read/write access through the helper script's use of readdir and copyFile.
Sanitization: No filtering or sanitization is applied to the prompt content before it is passed to the underlying model.
[DATA_EXFILTRATION]: The logic in scripts/codex-image.ts for handling the threadId is vulnerable to a directory traversal attack. The script extracts the thread_id from the Codex CLI's JSON output stream and uses it to construct a file path (join(codexHome, "generated_images", threadId!)) without validation. A malicious user could use prompt injection to trick the model into outputting a fake event line containing a traversal string (e.g., {"type": "thread.started", "thread_id": "../../../.ssh"}). Because the script updates threadId with the last matching event found in the output, the injected value would override the legitimate ID, causing the script to read from a sensitive directory and copy files (like SSH keys) to the output location designated by the user.

codex-image-gen