The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to use the --dangerously-bypass-approvals-and-sandbox and --skip-git-repo-check flags when executing the codex-smart tool. These instructions encourage the agent to circumvent critical security boundaries and automated safety checks, potentially allowing unvetted or malicious instructions from external sources to execute with elevated permissions.
[CREDENTIALS_UNSAFE]: The documentation instructs the agent to rely on and interact with ~/.codex, which is explicitly identified as the storage location for OAuth credentials. Accessing specific credential files in this manner is a high-risk practice that could lead to token exposure or unauthorized session use.
[PROMPT_INJECTION]: The skill establishes a workflow for indirect prompt injection by routing data to external, untrusted AI models and then ingesting the resulting text into the agent's environment.
Ingestion points: The agent is instructed to capture and read output from /tmp/codex-output.md (or similar paths under $CLAUDE_JOB_DIR) after external model invocation.
Boundary markers: There are no programmatic boundary markers or explicit instructions for the agent to treat the ingested data as potentially hostile instructions.
Capability inventory: The agent is given capabilities to execute shell commands via the codex-smart and gemini tools.
Sanitization: The skill lacks automated sanitization or validation logic for the external LLM output before it is processed by the agent.

cli-llm-routing