The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/launch-run.sh script dynamically creates a wrapper shell script (run.sh) at runtime, modifies its permissions with chmod +x, and executes it. This wrapper script handles the setup and execution of the codex CLI.
[PERSISTENCE]: The skill uses setsid or perl's POSIX::setsid() to launch delegated tasks in a new session. This detaches the task from the host harness (such as Claude Code or Cursor), allowing it to continue running even after the parent process terminates or the communication turn ends.
[COMMAND_EXECUTION]: The skill executes various system utilities including openssl for random ID generation, mkdir, cp, bash, and the primary codex CLI tool for task execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process "mission packets"—external markdown files containing goals and instructions. This architecture creates a surface for indirect prompt injection if the packets are generated from untrusted data, as they directly control the behavior and tool usage of the delegated agent. Evidence Chain:
Ingestion points: prompt.md file copied from external --packet input.
Boundary markers: prompt-packet.md template includes explicit 'Scope', 'Judgment authority', and 'Authority and pause conditions' sections.
Capability inventory: codex exec has access to tools, filesystem (workspace-write), and optional network access.
Sanitization: No explicit content filtering or sanitization of packet data is performed by the skill.
[DATA_EXFILTRATION]: The skill provides a --network-access flag which, when enabled, allows the delegated task to perform network operations from within a workspace-write sandbox. This capability could be leveraged to exfiltrate data from the workspace if a malicious mission packet is processed.

codex-delegate