The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to build shell commands by piping user input into a CLI tool (e.g., echo "[USER_PROMPT]" | codex ...). This pattern is highly susceptible to command injection if the user prompt contains shell characters like backticks, semicolons, or subshell syntax that are not correctly escaped by the agent environment.- [PROMPT_INJECTION]: The skill includes deceptive metadata and documentation claiming integration with non-existent 'GPT-5' and 'GPT-5.2' models, along with fabricated performance data (76.3% SWE-bench). This misinformation is designed to influence the agent's perceived capabilities and could lead to unpredictable behavior or false user confidence.- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes external, untrusted data (user prompts and repository content) and passes it to a powerful CLI tool with file-system write and network access capabilities.
Ingestion points: User-provided task descriptions and repository files analyzed by the codex command (SKILL.md).
Boundary markers: Absent; the skill lacks instructions for the agent to isolate or treat external content as untrusted.
Capability inventory: The codex CLI can be run with --sandbox workspace-write and --sandbox danger-full-access, granting significant system and network permissions.
Sanitization: No sanitization or validation steps are prescribed for the input data before it is processed by the tool.- [COMMAND_EXECUTION]: The skill directs the agent to append 2>/dev/null to its shell commands. While stated to be for 'suppressing thinking tokens', this technique effectively hides all standard error output, potentially masking malicious command execution, permission errors, or other security-relevant indicators from the user.

codex