The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses bash to execute CLI tools like cursor-agent, codex, and opencode with raw user input interpolated directly into the command string (e.g., codex exec "[user's complete request]"). This is a classic command injection vulnerability where a user can break out of the string using shell metacharacters (like ;, &, or |) to execute arbitrary system commands.
[REMOTE_CODE_EXECUTION]: The instruction specifically uses the --dangerously-bypass-approvals-and-sandbox flag with the codex tool. This explicitly disables security protocols and environmental isolation, allowing potentially malicious code to interact directly with the host system without restriction.
[DATA_EXFILTRATION]: Because the skill allows for arbitrary command execution and bypasses sandboxes, it creates a high-risk path for data exfiltration where system files, environment variables, or credentials could be sent to an external server.
[INDIRECT_PROMPT_INJECTION]: The skill lacks any input sanitization or boundary markers when processing user requests. It instructs the agent to 'Pass the user's request directly to the GPT-5 CLI without modification,' making it trivial for an attacker to manipulate the execution flow via the [user's complete request] ingestion point in SKILL.md (lines 20, 26, and 32).

oracle