The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions contain a behavioral override that commands the AI to 'NOT read or inspect the script source code' and 'Treat it as a black box.' This is a concealment pattern intended to prevent the AI from verifying the safety or integrity of the tools it executes.
[COMMAND_EXECUTION]: The skill invokes a secondary CLI tool (codex) via a wrapper script. The tool is executed with autonomous capabilities, including a --full-auto mode that allows for arbitrary workspace modifications and shell command execution as evidenced by the output parsing logic for command_execution and tool_call events.
[INDIRECT_PROMPT_INJECTION]: The skill creates a high-risk attack surface for indirect prompt injection by piping untrusted workspace data into a secondary autonomous agent.
Ingestion points: The script ask_codex.sh accepts a user-provided task and multiple file paths (via --file) which are read and processed by the secondary agent (SKILL.md, scripts/ask_codex.sh).
Boundary markers: No delimiters or safety instructions are used to separate the task instructions from the content of the files being read by the secondary agent.
Capability inventory: The secondary agent has documented capabilities for full workspace access, file writing, and shell command execution (SKILL.md, scripts/ask_codex.sh).
Sanitization: There is no evidence of sanitization or filtering applied to the file contents or the task prompt before they are processed by the autonomous Codex CLI.

codex