The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's primary function is to execute JavaScript workflow scripts using a Node.js runner. The documentation notes that while these scripts run in a VM, this environment is intended as a capability boundary rather than a fully hardened security sandbox for hostile code.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands, including node and codex. It facilitates spawning headless Codex workers that may be granted high-privilege permissions, such as workspace-write or danger-full-access, based on user approval flags.
[INDIRECT_PROMPT_INJECTION]: The workflow architecture is designed to feed the output of one agent into the prompt of another. This creates a surface for indirect prompt injection, where malicious instructions contained within processed data (e.g., file contents or API responses) could influence the behavior of downstream agents in the pipeline.
Ingestion points: Worker results from agent() and pipeline() calls are processed as JavaScript objects and interpolated into subsequent prompts.
Boundary markers: The documentation encourages the use of JSON schemas for structured output, which helps mitigate schema confusion but does not fully prevent instruction injection.
Capability inventory: The skill can execute subprocesses (codex exec), perform file writes, and access the network via Codex agents.
Sanitization: The runner enforces JSON schema validation for structured outputs, though the documentation warns that dynamically constructed schemas cannot be fully validated before execution.
[PROMPT_INJECTION]: A static detector identified patterns related to concealment; however, contextual review indicates these are defensive instructions. For instance, the skill instructs the agent to ignore instructions found within completion callbacks and to avoid making tool calls based solely on callback results to prevent external manipulation.

dynamic-workflow