The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/validate.sh script references and attempts to execute Python scripts located at hardcoded absolute paths (/Users/gurusharan/.codex/skills/...). This depends on an external, unverifiable environment and could lead to the execution of unauthorized code if those paths are present on the host system.
[COMMAND_EXECUTION]: The scripts agent-feedback-closeout.mjs and agent-feedback-preflight.mjs execute the system command lsof to check for active TCP listeners on the host. This is used for port availability checks during preflight and closeout operations.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-provided feedback. In scripts/agent-feedback-routing.mjs, user messages collected from the browser are interpolated directly into the prompt for sub-agents (buildWorkerPrompt) without sanitization or boundary markers.
Ingestion points: User comments are ingested via the /api/feedback endpoint in scripts/artifact-feedback-server.mjs and stored in data/feedback-queue.json.
Boundary markers: No boundary markers or instructions to ignore embedded commands are present in the worker prompts.
Capability inventory: The skill includes scripts for modifying files (test-agent-feedback-auto-runtime.mjs) and making network requests via webhooks.
Sanitization: No escaping or validation is performed on user messages before they are interpolated into the prompt.
[DATA_EXFILTRATION]: scripts/artifact-feedback-server.mjs includes a webhook notification system that sends artifact metadata and user-provided feedback to an external URL configured via environment variables. This creates a functional channel for sending potentially sensitive data to a remote endpoint.

agent-feedback-artifact