The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to insecure interpolation of user-provided data into tool instructions.
Ingestion points: Prompts and filenames are ingested from user input as documented in SKILL.md and as command-line arguments in scripts/codex_imagegen_batch.sh.
Boundary markers: The skill uses simple single-quote delimiters (') to wrap inputs within the instruction string. These are insufficient as they can be bypassed if the input contains a single quote.
Capability inventory: The skill uses codex exec with the workspace-write sandbox, which permits file system modifications.
Sanitization: No escaping, filtering, or validation is performed on the $prompt or $output variables before they are interpolated into the command string.
[COMMAND_EXECUTION]: The helper script scripts/codex_imagegen_batch.sh constructs shell commands for the codex CLI using unvalidated variables. While variables are double-quoted in the Bash script to prevent shell word splitting, the resulting string is passed to a secondary execution context (the Codex tool) that interprets the instructions, creating a risk if the input is maliciously crafted to break the instruction context.

codex-image