The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs aggressive imperative language and specific markers to override the agent's default behavior and internal reasoning processes.
Evidence: The use of tags like <EXTREMELY-IMPORTANT> accompanied by statements such as "IF A SKILL APPLIES... YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable. You cannot rationalize your way out of this."
Evidence: The "Red Flags" section instructs the agent to treat common logical checkpoints (e.g., "I need more context first", "This doesn't count as a task") as invalid "rationalizations" that must be ignored in favor of mandatory skill usage.
[PERSISTENCE]: The skill provides instructions for the agent to modify or suggest modifications to local application configuration files, which results in persistent environment changes.
Evidence: references/codex-tools.md contains specific TOML blocks meant to be added to ~/.codex/config.toml to enable multi_agent support and set default subagent models.
[INDIRECT_PROMPT_INJECTION]: The skill mandates a workflow that prioritizes instructions from external files that may contain untrusted data, without providing for sanitization or evaluation of those instructions.
Ingestion points: Workspace and home directory instruction files such as CLAUDE.md, GEMINI.md, AGENTS.md, SOUL.md, and application configs like ~/.codex/config.toml.
Boundary markers: Includes a conditional override stating "Only skip skill workflows or instructions when your human partner has explicitly told you to," which provides a human-controlled boundary but does not sanitize the skill content itself.
Capability inventory: The skill reference files map actions to high-privilege capabilities including subagent dispatch (spawn_agent, invoke_agent, delegate_task), file manipulation (write_file, patch), and terminal execution.
Sanitization: No explicit logic is provided for sanitizing or validating the instructions found in hierarchical markdown files or the skills being invoked.

using-superpowers