The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local session rollouts (JSONL files) which contain historical user inputs and model responses. This ingestion creates a surface for indirect prompt injection, as malicious instructions embedded in past conversations could be re-processed by the agent.
Ingestion points: The skill reads JSONL files from $HOME/.codex/sessions/ and $HOME/.codex/archived_sessions/ to generate transcripts and search history.
Boundary markers: Recipes for dumping transcripts use simple Markdown headers (e.g., ## User, ## Codex), which provide minimal separation between data and instructions.
Capability inventory: The skill utilizes jq, sqlite3, rg, and the codex CLI. While it can perform local actions like session deletion or archiving, it lacks network capabilities, limiting the potential impact of an injection.
Sanitization: No sanitization is performed on the historical text content before it is presented back to the agent.
[COMMAND_EXECUTION]: The skill includes several complex Bash recipes that execute system utilities such as sqlite3, jq, rg, find, and zstdcat. These tools are used to query local SQLite databases and parse compressed JSONL files. The sqlite3 recipe includes a specific input validation step using a shell case statement to ensure the $ID variable only contains alphanumeric hexadecimal characters, which mitigates local command injection risks.

exploring-codex-sessions