The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the external codex command-line tool to perform its core functions. It executes shell commands to check authentication status and run model inference tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to read repository content and provide it to an external AI model for evaluation. This creates a surface for indirect prompt injection if a malicious file exists within the repository. The skill mitigates this risk by recommending the -s read-only flag for the codex tool, which is intended to disable network access and write capabilities for the sub-agent.
Ingestion points: The skill reads files from the workspace specified by <repo root> and passes them to the codex exec command.
Boundary markers: The instructions recommend using -s read-only and suggest neutral framing ("Blind" mode) to avoid leading the model.
Capability inventory: The skill uses mkdir, bash redirections, and calls the codex binary.
Sanitization: Prompts are written to a scratchpad file (prompt.md) before execution to prevent shell-quoting errors and command injection through prompt variables.

second-opinion