The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to interact with sensitive credential files located at ~/.codex/auth.json. It explicitly suggests copying this file (cp ~/.codex/auth.json <CODEX_HOME>/auth.json) to manage tokens for isolated environments, which involves handling raw authentication data.
[COMMAND_EXECUTION]: The skill utilizes high-privilege execution flags. Specifically, it recommends the -s danger-full-access flag for the Codex CLI when running certain verifiers. This flag is designed to relax or bypass the standard workspace sandbox, allowing the background process broader access to the host system.
[COMMAND_EXECUTION]: The dispatch protocol involves shell command execution using command substitution ($(cat ...)) with paths in the /tmp/ directory. This pattern can be vulnerable to command injection if the input files or task identifiers are not strictly controlled.
[DATA_EXFILTRATION]: While no direct network exfiltration is configured in the scripts, the instructions facilitate the movement of authentication tokens into secondary directories (CODEX_HOME), increasing the surface area for potential credential exposure during background operations.

codex-runner