The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted user input which is then passed to a language model.
Ingestion points: User input is processed via the turn/start method in multiple files, including assets/node-stdio-starter/src/index.ts and assets/nextjs-web-sidecar/app/api/codex/session/route.ts.
Boundary markers: The provided starter code does not implement explicit boundary markers or delimiters for user input, relying instead on the underlying protocol.
Capability inventory: The skill documentation (e.g., references/protocol-and-events.md) confirms that the server can perform sensitive actions such as commandExecution and fileChange.
Sanitization: No explicit sanitization or validation of the user-provided text input is demonstrated in the client-side starter templates.
[COMMAND_EXECUTION]: The skill documentation and implementation provide mechanisms for executing commands on the host system.
Evidence: The protocol supports a commandExecution item type, as described in references/protocol-and-events.md. While the protocol includes a requestApproval flow, this functionality grants the agent the ability to execute shell commands if the user or host app approves.
[DYNAMIC_EXECUTION]: The skill relies on spawning a local sidecar process to handle the application logic.
Evidence: The Node.js and Swift starter codes (e.g., assets/existing-app-auth-bridge/src/client.ts and assets/swift-bridge-patterns/MacOSProcessBridge.swift) use child_process.spawn and Process to execute the codex binary from the system PATH. This is a core architectural feature of the integration but constitutes dynamic process execution.

codex-app-server