The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to build and execute shell commands using variables that can be influenced by user input, specifically the <model>, <effort>, and <SESSION_ID> parameters. If the agent fails to strictly validate or sanitize these values before constructing the command string, it could be vulnerable to command injection attacks.
[PROMPT_INJECTION]: The skill implements a workflow that inlines untrusted user content (plans, drafts, ideas) directly into the prompt sent to the Codex CLI. This creates a surface for indirect prompt injection, where malicious instructions hidden in the discussed content could override the Codex agent's behavior.
Ingestion points: The user's trigger message and any files referenced by path in the conversation.
Boundary markers: The skill uses markdown headers to separate sections in the prompt but lacks explicit delimiters or instructions for the Codex model to ignore embedded commands within the user content.
Capability inventory: The skill utilizes shell execution via the codex exec and codex exec resume commands.
Sanitization: No sanitization or escaping of the inlined user content is specified in the instructions.
[DATA_EXPOSURE]: The skill is designed to read the user's local configuration at ~/.codex/config.toml and manage session data in ~/.codex/sessions/. While this is part of the tool's intended orchestration, it involves the handling of potentially sensitive local system paths.

codex-discuss