The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands (e.g., codex exec) using variables such as $GOAL_DIR and $ACTIVE_TYPE derived from local filesystem paths and file contents. This pattern is highly vulnerable to command injection; an attacker could craft malicious directory names or YAML content (e.g., docs/goals/$(touch EXPLOIT)/) that would be executed by the shell during interpolation.
[EXTERNAL_DOWNLOADS]: The skill requires the global installation of the @openai/codex NPM package. While the organization scope is recognized, this is not a standard OpenAI library, and global package installation creates persistent changes to the system and introduces supply-chain risks from unverified dependencies.
[PROMPT_INJECTION]: The skill contains deceptive metadata and instructions referencing non-existent AI models (gpt-5.5, gpt-5.4) to claim cost and performance advantages. This is a form of metadata poisoning that could mislead users and agents into relying on a tool with unverified and potentially misrepresented capabilities.
[PROMPT_INJECTION]: The skill implements an indirect injection surface by processing data from goal.md and state.yaml and passing it to an external model with high-privilege capabilities.
Ingestion points: docs/goals/<slug>/goal.md and state.yaml in the local workspace.
Boundary markers: Uses check-goal-state.mjs to validate board structure, but this does not provide sanitization of natural language content.
Capability inventory: Access to codex exec, which performs network operations, executes shell commands, and has workspace-write permissions.
Sanitization: No content sanitization is performed before passing data to the external model; shell variable interpolation for paths and types is unescaped.

codex-goal