The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands that interpolate a user-provided <prompt> directly into a command string: node "$COMPANION" task "<prompt>". This pattern is highly susceptible to shell command injection. If a user provides a prompt containing shell metacharacters (such as backticks, semicolons, or dollar-sign parentheses), they could execute arbitrary code on the host machine even when the prompt is enclosed in double quotes.
[PROMPT_INJECTION]: The skill facilitates an indirect prompt injection attack surface (Category 8) by design. It allows untrusted user input to be forwarded to a powerful external runtime that specifically supports write operations on the target repository.
Ingestion points: Untrusted data enters via the <prompt> variable in the canonical invocation command described in SKILL.md.
Boundary markers: The skill recommends using single-quoted heredocs for long prompts but demonstrates unsafe double-quoting in its primary examples, providing insufficient protection against adversarial input.
Capability inventory: The skill explicitly requests writes_to permissions for the target workspace and supports destructive operations via the --write flag.
Sanitization: No sanitization, escaping, or validation logic is provided to ensure the prompt text does not contain malicious instructions intended for the underlying Codex model.
[EXTERNAL_DOWNLOADS]: The skill relies on an external runtime script (codex-companion.mjs) located in the user's home directory or a plugin root. While the skill does not download this script at runtime, it executes arbitrary code from an external vendor source, creating a dependency on the security and integrity of that external component.

codex-cli-runtime