The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the sensitive ~/.codex/auth.json file to retrieve user authentication tokens. Directly reading credential files from scripts is a high-risk activity that exposes the user to data theft.\n- [REMOTE_CODE_EXECUTION]: The skill executes npx -y openai-oauth, downloading and running code from an untrusted third-party developer. This allows arbitrary code execution within the user's environment.\n- [EXTERNAL_DOWNLOADS]: The skill dynamically downloads the openai-oauth package at runtime from an unverified source, posing a potential supply chain risk.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the @openai/codex package from a well-known service to facilitate the authentication process.\n- [COMMAND_EXECUTION]: The skill performs shell-based process management, including starting background tasks, monitoring network ports using lsof, and terminating processes with kill.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface where user-provided text is interpolated into a tool call payload without sanitization.\n
Ingestion points: User prompt in SKILL.md interpolated into the input array of the JSON payload.\n
Boundary markers: No delimiters or ignore instructions are present to isolate user content.\n
Capability inventory: Shell execution, background process management, and network communication.\n
Sanitization: No escaping or validation is performed on the user-supplied prompt.\n- [REMOTE_CODE_EXECUTION]: The skill uses a Python heredoc to dynamically generate and execute a script at runtime for processing server-sent events.

gpt-image2-ratos