The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and follow instructions from a file located at a specific local path: ~/.codex/plugins/cache/openai-bundled/computer-use/<version>/skills/computer-use/SKILL.md. This creates an ingestion point where untrusted or malicious instructions could be introduced into the agent's context if the file is modified by other software or processes.
Ingestion points: Instructions are read from ~/.codex/plugins/cache/openai-bundled/computer-use/<version>/skills/computer-use/SKILL.md (documented in references/legacy-runtime.md).
Boundary markers: None. The skill explicitly states that the instructions found in the external file are 'authoritative'.
Capability inventory: The skill has access to UI control, browser control, and code execution via the mcp__cua_repl__js and mcp__node_repl__js tools (documented in SKILL.md and references/legacy-runtime.md).
Sanitization: No sanitization or validation of the external instructions is specified before the agent is told to follow them.
[DYNAMIC_EXECUTION]: The skill uses a Node.js REPL tool (mcp__node_repl__js) to dynamically import a library (@oai/sky) and bind it to a global variable. This involves executing JavaScript code to modify the runtime environment.
Evidence: The code snippet globalThis.sky = (await import("@oai/sky")).sky; nodeRepl.write("sky: " + typeof sky); in references/legacy-runtime.md executes within the agent's environment.
[COMMAND_EXECUTION]: The skill's primary purpose is to interact with REPL (Read-Eval-Print Loop) environments to control system interfaces and execute code.
Evidence: The skill is designed to interact with mcp__cua_repl__js and mcp__node_repl__js tools as described throughout SKILL.md and references/legacy-runtime.md.

codex-computer-use