The Agent Skills Directory

[COMMAND_EXECUTION]: The skill identifies and executes a shell script named codex-worker.sh from specific local paths, including ${CLAUDE_PLUGIN_ROOT}, $HOME/.claude/, and $HOME/skills/. It uses this script to perform both system probes and model execution tasks.
[DATA_EXFILTRATION]: The skill aggregates workspace content and user-defined prompts to send to an external OpenAI model via the Codex CLI. While the documentation notes that this uses the user's own OpenAI account, it involves the transfer of local project data to a remote service.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data such as designs, diffs, and code from the workspace to be reviewed by a secondary AI model. This creates a vector where malicious instructions hidden in the material under review could influence the model's output.
Ingestion points: The contents of prompt.md which includes material quoted from the workspace.
Boundary markers: The instructions suggest including only necessary material but do not implement strict delimiters or escaping for the quoted content.
Capability inventory: The skill executes a background bash job (codex-worker.sh run) that accesses the workspace.
Sanitization: There is no evidence of sanitization or filtering of the ingested workspace material before it is sent for review.

second-opinion