The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to perform an "escalated, read-only host process check" to verify the PID of the codex_chronicle executable found in $TMPDIR/codex_chronicle/chronicle-started.pid. Operations requiring escalated permissions are high-risk.
[DATA_EXFILTRATION]: The skill accesses highly sensitive user privacy data, including a rolling buffer of screen recordings and OCR text history located in $TMPDIR/chronicle/screen_recording/ and ~/.codex/memories/extensions/chronicle/.
[DATA_EXFILTRATION]: The agent is instructed to extract document identifiers (such as Google Doc IDs) from screen captures to trigger external connectors, creating a mechanism where sensitive data from the screen buffer can be passed to third-party services.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the user's screen captures and OCR logs.
Ingestion points: Screen recording JPEG frames and append-only OCR history files (.ocr.jsonl) in $TMPDIR/chronicle/screen_recording/.
Boundary markers: Absent; there are no instructions for the agent to use delimiters or ignore embedded commands within the processed screen data.
Capability inventory: File system access, text search using rg, escalated process verification, and the ability to trigger external app connectors.
Sanitization: No validation or sanitization is performed on the text extracted from images before it is used to drive further agent actions.
[EXTERNAL_DOWNLOADS]: The skill references technical documentation and original implementation details hosted on OpenAI's official GitHub repository (https://github.com/openai/codex).

chronicle