The Agent Skills Directory

[COMMAND_EXECUTION]: The /skill setup and /skill scan functionalities include bash scripts designed to be run by the agent. These scripts use find, grep, and mkdir to interact with the local filesystem, including a -exec sh -c pattern that spawns sub-shells to parse metadata from files in ~/.codex/skills/ and .codex/skills/.- [EXTERNAL_DOWNLOADS]: The 'Import Skill' functionality explicitly allows the agent to download content from arbitrary URLs, such as GitHub Gists, and save it to the local filesystem. This facilitates the introduction of unverified and potentially malicious instructions into the agent's execution environment.- [INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the .codex/skills/ directory within project folders, which can ingest untrusted content from external repositories.
Ingestion points: The agent reads and parses YAML frontmatter and full markdown content from all .md files in the user and project skill directories.
Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores or treats cautiously any instructions embedded within the processed skill files.
Capability inventory: The skill possesses capabilities for shell command execution (find, sh -c), file writing, and directory removal (rm -rf equivalent via /skill remove).
Sanitization: Naming conventions are enforced for new skills, but no sanitization or validation is performed on the markdown content being imported or read.- [DATA_EXFILTRATION]: The /skill info command is designed to output the 'FULL CONTENT' of skill files to the conversation. If these files contain sensitive information, environment variables, or hardcoded secrets, this data will be exposed in the agent's context and conversation history.

skill