The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains instructions directing the agent to execute shell commands (codex mcp add) to install software from external network sources.
[PROMPT_INJECTION]: The skill includes an explicit directive in SKILL.md to bypass security restrictions by automatically retrying failed installations with "escalated permissions." The instructions specifically tell the agent, "Do not ask the user to run it yet," which is an attempt to evade user oversight and sandbox constraints.
[PROMPT_INJECTION]: The skill provides highly deceptive metadata in SKILL.md and throughout the references/ directory, claiming the existence of non-existent OpenAI models (e.g., "GPT-5.4", "gpt-oss-120b", "sora-2-pro") and citing false licensing terms (e.g., "gpt-oss" reasoning models under Apache 2.0). This misinformation can lead to significant errors in agent behavior or API interactions.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface.
Ingestion points: User queries regarding OpenAI product guidance and model selection (SKILL.md).
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded directives in the reference files.
Capability inventory: Subprocess execution via codex command line (SKILL.md).
Sanitization: Absent; the skill interpolates content from references/ directly into the agent's decision-making workflow without filtering or validation.

openai-docs