The Agent Skills Directory

[COMMAND_EXECUTION]: The bash reference runner provided in Section 3 is vulnerable to command injection. The script uses xargs -I{} bash -c 'j={}; ...' to process task lines. If the input tasks.jsonl contains a maliciously crafted JSON string (e.g., containing single quotes or shell metacharacters like $(...)), it can break out of the shell variable assignment and execute arbitrary commands on the host system.
[PRIVILEGE_ESCALATION]: The skill documentation and the Python runner script promote the use of the --dangerously-bypass-approvals-and-sandbox flag. This instruction explicitly encourages users to disable the agent's built-in safety mechanisms, including sandboxing and human-in-the-loop approvals, which is high-risk for automated batch processing.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process batches of instructions from an external file (tasks.jsonl). This creates a significant surface for indirect prompt injection.
Ingestion points: The tasks.jsonl file processed by codex_spawn_runner.py and the bash script.
Boundary markers: None. The prompts are extracted from JSON and passed directly to the codex exec command.
Capability inventory: The worker processes (codex exec) have the capability to read/write files and execute code, potentially with sandboxing disabled as per the skill's instructions.
Sanitization: No sanitization or validation of the input prompts is performed before execution.
[COMMAND_EXECUTION]: The Python runner uses subprocess.run to spawn multiple worker processes. While safer than the bash variant, the overall architecture relies on executing commands based on inputs from a data file that may be sourced from untrusted external environments (e.g., automated processing of public repository code).

codex-spawn