The Agent Skills Directory

[SAFE]: The skill functions as a documentation and discovery utility. It does not contain any instructions for network access, persistence, privilege escalation, or remote code execution.
[DATA_EXPOSURE_EXFILTRATION]: The skill incorporates explicit negative constraints to prevent unauthorized data access. It specifically instructs the agent not to read sensitive files like .env, credentials, authentication sessions, shell histories, or global runtime directories. Additionally, it restricts configuration reporting to structural key names only, ensuring that sensitive values are never retrieved or reported.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific configuration and rule files which could contain untrusted data. 1. Ingestion points: Files in .codex/rules/, .codex/skills/, and explicitly named project Codex config files (SKILL.md). 2. Boundary markers: Explicit instructions to report structural key names only and record file metadata (path, format, purpose) instead of content. 3. Capability inventory: Use of rg --files for discovery and local file writes for reporting. 4. Sanitization: The structural extraction process serves as a functional filter that prevents the agent from interpreting or echoing the full content of potentially malicious instructions.

update-overview