The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses sensitive local files at ~/.codex/sessions.
This path contains user session history, including pastedContents which often holds sensitive code, configuration data, or internal identifiers.
The skill is instructed to analyze this data and deliver a report to an external service (Slack) using the RUBE_MULTI_EXECUTE_TOOL.
There are no instructions to sanitize, filter, or redact sensitive information (like hardcoded credentials or private keys) that might be present in the chat logs before they are summarized and transmitted externally.
[PROMPT_INJECTION]: Vulnerable to indirect prompt injection via the processing of untrusted chat history.
Ingestion points: Reads local chat history from ~/.codex/sessions (JSONL format).
Boundary markers: The instructions do not define delimiters or provide "ignore embedded instructions" warnings for the agent when it processes content from these files.
Capability inventory: The skill has the ability to read local files and perform network operations via RUBE_SEARCH_TOOLS and RUBE_MULTI_EXECUTE_TOOL (Slack integration).
Sanitization: The skill lacks any content validation or sanitization steps for the data ingested from the chat history, potentially allowing embedded instructions in past chats to influence the agent's report generation or tool usage.

developer-growth-analysis