The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct shell commands by piping user-provided prompts directly into a CLI tool (e.g., echo "prompt" | codex exec). This pattern is vulnerable to shell injection if the agent does not properly escape metacharacters in the user input.\n- [METADATA_POISONING]: The skill's documentation and instructions reference non-existent AI models (such as GPT-5.2 and GPT-5.1-thinking) and cites unverified performance statistics (e.g., 76.3% SWE-bench). This deceptive metadata can lead to misplaced trust in the tool's capabilities.\n- [OBFUSCATION]: The skill mandates the use of 2>/dev/null in CLI commands to suppress stderr output. This practice hides internal process information, errors, and warnings from the user and the agent's monitoring interface.\n- [PRIVILEGE_ESCALATION]: The instructions promote the use of a danger-full-access sandbox mode for the external CLI, which grants the tool broad system and network permissions, increasing the potential impact of a compromise.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user prompts and potentially external code to pass to the CLI.\n
Ingestion points: User prompts and repository code in SKILL.md.\n
Boundary markers: Absent; the skill does not use delimiters to isolate untrusted data.\n
Capability inventory: Shell command execution via codex exec (found in SKILL.md).\n
Sanitization: Absent; no escaping or validation of inputs before piping to the CLI.\n- [EXTERNAL_DOWNLOADS]: The installation instructions in README.md reference cloning the skill repository from GitHub.

codex