The Agent Skills Directory

[SAFE]: The skill implements robust security controls for file operations. The scripts/setup-codex.ps1 script includes a custom Assert-UnlinkedPath function that recursively checks paths to prevent operations on symbolic links or junctions, mitigating path traversal and unauthorized file overwrite risks.
[SAFE]: The installation process enforces a secure multi-step approval workflow. It utilizes SHA256 hashing (ApprovedContentHash and ExpectedTargetHash) to ensure that the content the user reviews during the preview phase is exactly what is written to the destination, protecting against 'Time-of-Check to Time-of-Use' (TOCTOU) attacks or concurrent edits.
[SAFE]: The skill includes automatic backup functionality, preserving the original AGENTS.md file in a uniquely named backup directory before any modifications are applied.
[SAFE]: User input for language preferences is sanitized via a strict regex (^[^ {}]{1,80}$), which prevents the injection of newlines or template markers ({}) that could interfere with the instruction generation process.
[COMMAND_EXECUTION]: The file scripts/test_setup_codex.py utilizes subprocess.run() to execute the skill's own PowerShell installer. This activity is restricted to a controlled unit testing environment using temporary directories and is not part of the runtime execution against user data.

setup-codex