The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to invoke the external codex CLI tool to perform work on behalf of the agent. The wrapper script scripts/codex.py uses subprocess.run to call the CLI binary with specific arguments for task execution and sandboxing.
[DYNAMIC_EXECUTION]: The script dynamically identifies the location of the codex binary at runtime. It searches environment variables, the system PATH, and specific subdirectories within the OpenAI ChatGPT VS Code extension bundle (~/.vscode/extensions/openai.chatgpt-*). While this involves locating and executing a binary not shipped directly with the skill, the search targets known and expected locations for a specific developer tool.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external data (e.g., from a scratch file or stdin) to be used as instructions for the Codex CLI. This creates a surface where embedded instructions in processed data could potentially influence the behavior of the delegated agent.
Ingestion points: The scripts/codex.py script includes a --read flag that ingests content from a specified file or stdin to be passed to the CLI.
Boundary markers: The wrapper script does not explicitly implement boundary markers for ingested data, although the SKILL.md instructions emphasize the importance of reviewing all diffs produced by the tool.
Capability inventory: The wrapper script can execute the codex CLI via subprocess.run. The CLI itself can be configured with varying sandbox levels (read-only, workspace-write, etc.) to restrict its access to the host system.
Sanitization: The wrapper script passes data to the CLI without sanitization, relying on the CLI's internal safety controls and the user's manual review of outputs.

codex-agents