The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for cloning external repositories and checking out pull requests to be processed by an autonomous coding agent. This creates a significant surface for indirect prompt injection where malicious instructions embedded in a PR or repository could influence the agent's behavior.
Ingestion points: The skill uses git clone and gh pr checkout in SKILL.md to bring untrusted remote code into the local environment.
Boundary markers: There are no specific delimiters or instructions provided to the agent to ignore embedded commands within the files it reviews or processes.
Capability inventory: The skill utilizes the terminal tool to execute shell commands and launch the autonomous codex process, which has the capability to modify the filesystem and run code.
Sanitization: No sanitization or validation of the remote content is performed before it is passed to the autonomous agent.
[COMMAND_EXECUTION]: The skill relies extensively on the terminal tool to run the codex CLI and various git and gh commands. It specifically suggests using the --yolo flag, which is documented to bypass approval prompts and sandboxing, increasing the risk of unintended or malicious command execution if the agent is compromised by untrusted data.
[DYNAMIC_EXECUTION]: The core functionality of the skill involves launching an autonomous agent (codex) that dynamically generates and executes code based on natural language prompts. While this is the intended purpose, it represents a dynamic execution engine that can be targeted by adversarial inputs during its operation.

codex