The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python helper script to interface with the local codex command-line tool. Analysis of scripts/send_to_codex.py shows that subprocess.run is used with a list of arguments and shell=False (default), which effectively mitigates command injection risks.
[DATA_EXFILTRATION]: Instructions in SKILL.md explicitly forbid the transmission of sensitive information such as API keys, tokens, and .env file contents. This reduces the risk of accidental secret exposure during the handoff process.
[INDIRECT_PROMPT_INJECTION]: The skill relays agent-generated content to an external tool. 1) Ingestion points: Untrusted data enters via the --message, --file, or stdin inputs in scripts/send_to_codex.py. 2) Boundary markers: SKILL.md mandates a structured format starting with [Claude handoff]. 3) Capability inventory: The skill uses subprocess.run in scripts/send_to_codex.py to call the local CLI. 4) Sanitization: The scripts/send_to_codex.py script performs regex-based validation on the task ID and ensures content is passed as a command argument list, preventing it from being interpreted as shell commands.
[DYNAMIC_EXECUTION]: The test file scripts/test_send_to_codex.py utilizes importlib to dynamically load the logic from scripts/send_to_codex.py. This is a routine technique for unit testing local Python files and does not involve loading untrusted external code.

codex-handoff