The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a custom Bash wrapper (scripts/run-codex-handoff.sh) to execute the codex CLI for both research and implementation tasks.
[PRIVILEGE_ESCALATION]: Implementation subagents are launched with the --dangerously-bypass-approvals-and-sandbox flag. This configuration explicitly disables the AI agent's security sandbox and manual approval steps, granting subagents full permissions to read, modify, or delete any files accessible to the host user.
[INDIRECT_PROMPT_INJECTION]: The skill automatically ingests instructions from 'companion skills' by reading SKILL.md files from local directories (~/.claude/skills/ and ~/.agents/skills/). The content from these files is directly incorporated into prompts for high-privilege subagents. * Ingestion points: Local filesystem paths for skill definitions. * Boundary markers: Although the skill instructions define authority boundaries for subagents, these boundaries are defined within prompts that include the potentially untrusted companion skill content. * Capability inventory: Subagents possess broad filesystem access and command execution capabilities due to the disabled sandboxing. * Sanitization: There is no evidence of sanitization or safety filtering of the companion skill content before it is processed by the agent orchestrator.

codex-handoff