The Agent Skills Directory

[COMMAND_EXECUTION]: The file references/codex-chair.md provides an example command codex exec utilizing the --dangerously-bypass-approvals-and-sandbox flag. This flag is designed to explicitly circumvent built-in security controls and execution sandboxes, posing a high risk of unauthorized system access if the input files are compromised.- [REMOTE_CODE_EXECUTION]: The adapter logic in references/codex-chair.md facilitates the execution of reviewer logic from external files using the codex exec tool. When paired with the safety bypass flag, this allows for the execution of arbitrary logic outside the agent's standard security boundaries.- [PROMPT_INJECTION]: The skill's primary function is to ingest and process a 'proposal' file and associated 'source paths' from the environment. This ingestion point, documented in SKILL.md, creates a surface for indirect prompt injection where a malicious proposal could contain instructions designed to manipulate the 'chair' agent or the 'reviewer' seats during the synthesis and disposition phases. Every Category 8 finding MUST document all four elements: (1) Ingestion points: Proposal file and source paths in SKILL.md. (2) Boundary markers: The protocol requires specific structured headers (## Plan verdict, ## Findings) to delimit analysis. (3) Capability inventory: Subprocess calls (mkdir, ls, wc) and codex exec in SKILL.md and references/codex-chair.md. (4) Sanitization: The instructions mandate 'existence checks only' for secrets, though no formal string escaping is implemented for the proposal content.
[DATA_EXFILTRATION]: Although the skill includes instructions to avoid passing credential values ('existence checks only'), the combination of shell-based scratchpad directories (<session-scratchpad>/counsel/) and external command execution with bypassed sandboxes provides a technical pathway for data exfiltration if the agent is successfully subverted.

counsel