The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions explicitly direct the agent to launch sub-processes using the --dangerously-bypass-approvals-and-sandbox flag. This flag is intended to disable platform-level safety guardrails, including automated sandboxing and human-in-the-loop approval requirements for dangerous actions.
[COMMAND_EXECUTION]: The orchestration logic relies on tmux send-keys to transmit instructions into active worker sessions. This pattern is vulnerable to injection:
Ingestion points: The skill processes external data such as issue descriptions, task names, and user-provided triage prompts (referenced in SKILL.md under the 'Parallel fan-out' section).
Boundary markers: No delimiters or safety warnings are used when interpolating external strings into the tmux send-keys command.
Capability inventory: The skill possesses extensive system capabilities including git (filesystem modification via worktrees), tmux (terminal session control), and codex (autonomous code execution).
Sanitization: There is no evidence of sanitization or escaping for shell metacharacters or tmux control sequences within the variables $PROMPT or $NAME. An attacker-controlled task description could potentially break out of the intended context and execute arbitrary commands within the host shell or the managed tmux panes.

codex-worker