The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in Python and bash -c in shell scripts to execute the codex CLI tool. The Bash script variant is specifically vulnerable to command injection as it interpolates values from the input JSONL file directly into a shell command string: "... Prompt: $(jq -r .prompt <<<"$j"). ...". If the prompt field in the input file contains backticks or subshell markers (e.g., $(...)), those commands will be executed on the host system.
[PRIVILEGE_ESCALATION]: The skill explicitly uses the --dangerously-bypass-approvals-and-sandbox flag with codex exec. This flag is designed to disable security restrictions and automated approval prompts, significantly increasing the risk if the agent is manipulated into performing unintended actions.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from a file (prompts.jsonl) and interpolates it directly into instructions for the agent. This creates a surface for indirect prompt injection attacks.
Ingestion points: The prompts.jsonl file serves as the primary entry point for untrusted data into the agent's context.
Boundary markers: There are no boundary markers or sanitization logic to separate the user-provided prompt from the system instructions.
Capability inventory: The skill has the capability to execute shell commands via subprocess.run and move files on the local filesystem using shutil.move.
Sanitization: No validation or escaping is performed on the content of the prompt field before it is used in the command execution flow.
[REMOTE_CODE_EXECUTION]: While the skill primarily executes a local CLI tool, the ability to inject commands through the input file (as noted in the Command Execution section) effectively allows for arbitrary code execution on the user's machine.

codex-imagegen