The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute sqlite3 shell commands to query the local Codex database located at ~/.codex/state_5.sqlite. It uses these commands to retrieve session metadata such as titles, working directories, and git information.
[DATA_EXFILTRATION]: The skill accesses sensitive local data stored in the ~/.codex/ directory, including the state_5.sqlite database and JSONL rollout files. These files contain user session history, workspace paths, and message content. This information is exposed to the agent context to facilitate the search and metadata retrieval tasks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from session titles and message rollout files. Malicious content within these files could potentially influence the agent's behavior.
Ingestion points: ~/.codex/state_5.sqlite (for session titles), session_index.jsonl, and conversation rollout files in the sessions/ directory.
Boundary markers: The instructions do not specify any delimiters or warnings to treat the retrieved session content as untrusted data.
Capability inventory: The skill possesses file read capabilities (via sqlite3 and direct access) and file write capabilities (exporting to /tmp/).
Sanitization: There is no evidence of sanitization or filtering applied to the retrieved session data before it is presented to the agent or exported.

codex-session-finder