The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent on the use of the codex-cli tool with the --dangerously-bypass-approvals-and-sandbox flag. This flag is documented as a way to achieve a "fully autonomous run with no gating at all," which explicitly disables standard security approval prompts and sandbox restrictions for the sub-agent.
[COMMAND_EXECUTION]: The skill highlights the danger-full-access tier for the codex exec command. This tier is described as having "no sandbox at all," which grants the delegated process unrestricted access to the local machine within the target directory, including file system modifications and command execution.
[PROMPT_INJECTION]: The skill defines a delegation pattern where "metaprompts" are interpolated into shell commands. This creates a vulnerability to indirect prompt injection if untrusted content from the codebase (such as code comments, PR bodies, or issue descriptions) is included in the prompt without sanitization or boundary markers.
Ingestion points: Metaprompts passed to codex exec as command-line arguments or via stdin in SKILL.md.
Boundary markers: None provided in the command templates to separate instructions from potentially malicious data.
Capability inventory: The delegated sub-agent possesses file-write capabilities and the ability to execute arbitrary commands, potentially with network access if the full-access tier is used.
Sanitization: The skill recommends a post-execution "supervision loop" for manual verification of changes, but does not provide mechanisms for pre-execution sanitization or filtering of the interpolated prompts.

codex-cli