The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator script scripts/run-codex-sync.mjs uses node:child_process.spawn to execute a sequence of 16 different scripts located in the .claude/ directory. These scripts perform migrations, sync hooks, and run various verification tests.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that explicitly direct the agent to bypass user confirmation for certain actions. Specifically, the [WORKFLOW-EXECUTION-PROTOCOL] instructs the agent to 'AUTO-SELECT: Pick the best option yourself. Do not ask the user to choose', and the 'Subagent authorization' section states that invoking the skill 'authorizes use of the required spawn_agent subagent(s)'. These patterns are designed to increase agent autonomy and reduce user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill mirrors instructional content from CLAUDE.md into AGENTS.md. This creates a surface where malicious instructions in the source file could be propagated into the agent's primary context files.
Ingestion points: CLAUDE.md and various files under docs/project-reference/ are read during the sync process.
Boundary markers: The mirroring process from CLAUDE.md to AGENTS.md does not appear to use sanitization or explicit 'ignore instructions' boundary markers for the copied content.
Capability inventory: The orchestrator has the capability to spawn subprocesses (spawn) and write to the filesystem (stages 1-3).
Sanitization: No evidence of sanitization or content validation is present for the data being mirrored.

sync-codex