The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/loop.mjs executes an external binary (defaulting to codex) to perform scheduled tasks.
It utilizes child_process.spawnSync with an arguments array and pipes user input via stdin, which effectively prevents shell injection attacks.
The skill implements a robust 'default-deny' allowlist for additional command arguments, permitting only vetted flags like --model. This prevents the execution of dangerous flags such as --sandbox or --yolo that could be used to bypass security constraints.
Users can specify an alternative binary path via the --codex-bin flag, which is a standard feature for this type of developer tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts which are then executed by an external command, representing a potential surface for indirect injection if the prompts are sourced from untrusted data.
Ingestion points: The --prompt flag and the command spec string processed in scripts/loop.mjs (via parseLoopSpec).
Boundary markers: Absent. The prompt content is passed directly to the execution tool without delimiters or safety warnings.
Capability inventory: The skill has the capability to execute local commands and perform file system operations (writing logs) via scripts/loop.mjs.
Sanitization: Absent for the prompt content; while the skill rigorously sanitizes command-line parameters, it does not filter or sanitize the actual content of the user-provided prompt string.

loop