The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/run.sh wrapper script is vulnerable to shell command injection. It uses zsh -lc to execute the Python auditor and interpolates the ${CODEX_HOME_DIR} and ${OUT_DIR} variables directly into the command string. If these paths are influenced by untrusted input and contain shell metacharacters (e.g., double quotes or backticks), an attacker could execute arbitrary commands.
[COMMAND_EXECUTION]: The skill implements a decision feedback protocol that executes a local Python utility script (record_skill_feedback.py) at a specific relative path to persist telemetry and user decisions.
[DATA_EXFILTRATION]: The skill performs extensive reads of local configuration files (config.toml), hooks, and instruction metadata. While it includes robust logic to redact secrets and credentials from the generated report, the collection of this metadata constitutes a sensitive data handling surface.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the local environment (e.g., hooks.json, .rules, and instruction files).
Ingestion points: The Python auditor reads contents from config.toml, .rules files, and various Markdown instruction files in the target home directory.
Boundary markers: None; the content is read and processed as raw text or structured data.
Capability inventory: The skill can write files to the local system (Path.write_text) and execute shell commands via the run.sh wrapper.
Sanitization: The script implements heuristic redaction for common secrets (API keys, tokens) and truncates large files to prevent context window exhaustion.

codex-home-audit