The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to route all user messages to a local 'Codex App Server' by default, creating an attack surface where responses from the server could influence the agent's behavior.
Ingestion points: The scripts/bridge.py poll command, which retrieves events and messages from the local Codex server via an SQLite store.
Boundary markers: The SKILL.md file defines strict rules for the agent, including requiring user confirmation for mode selection, directory trust changes, and service request responses.
Capability inventory: The agent is authorized to execute the codex CLI (queue, archive), write to $CODEX_HOME/config.toml to modify trust levels, and manage a background daemon process via the provided Python scripts.
Sanitization: The scripts/store.py script includes an output_item function that truncates command output to 200 characters before it is presented to the agent.
[DYNAMIC_EXECUTION]: The skill provides a template in references/cli-examples.md that requires the agent to generate and execute a Python script using a shell heredoc (`python3
<<'PY'`). This script performs RPC calls to the local Unix socket to initialize sessions.
[COMMAND_EXECUTION]: The skill's core functionality involves managing a background bridge daemon. The scripts/client.py script uses subprocess.Popen to launch scripts/bridge.py serve. Additionally, instructions in SKILL.md and references/cli-examples.md guide the agent to execute various shell commands involving the codex CLI and python3.

codex