The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's workflow in SKILL.md instructs the agent to execute a Python script (export_codex_session.py) using arguments derived from user input, such as --session-file and --output. This provides a direct path for an attacker to influence the script's behavior with malicious file paths.
[DATA_EXFILTRATION]: The script scripts/export_codex_session.py allows the agent to read any file on the system via the --session-file argument. While it attempts to parse the content as JSONL, the lack of path validation allows the process to resolve and open sensitive files anywhere the user has permissions.
[PERSISTENCE]: The script allows writing output to arbitrary locations via the --output and --output-dir arguments. Because the script does not validate that the target path is within a safe directory, an attacker could trick the agent into overwriting critical configuration files like ~/.bashrc or ~/.zshrc to execute malicious code automatically in future sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes session logs which contain untrusted user and assistant messages. While the script includes a redact_skill_context_blocks function to filter out internal instructions, this logic relies on specific string patterns that can be bypassed, potentially allowing malicious instructions embedded in logs to influence the agent during the export process.
Ingestion points: The script reads JSONL files from ~/.codex/sessions, ~/.codex/archived_sessions, or paths provided via the --session-file argument.
Boundary markers: The script attempts to detect and redact blocks wrapped in <skill> tags or other specific markers like # AGENTS.md instructions.
Capability inventory: The script has the ability to read arbitrary files, create directories, and write text files to the disk.
Sanitization: The script filters content based on specific JSON keys (payload.message, payload.content) and applies regex-based redaction for known internal instruction formats.

export