The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install components by cloning from https://github.com/skills-directory/skill-codex.git. This source is not a recognized trusted vendor, which constitutes a risk of installing and executing unverifiable external code.
[COMMAND_EXECUTION]: The skill documentation encourages using the codex CLI with flags such as --full-auto and --sandbox writable. This configuration allows the external tool to autonomously modify the user's codebase and file system without requiring individual confirmation for each edit.
[INDIRECT_PROMPT_INJECTION]: The skill processes repository content as input for the Codex agent, which represents an attack surface where malicious instructions hidden in code could influence the agent's behavior.
Ingestion points: Entire repository analysis and specific file targeting via codex exec commands as described in SKILL.md.
Boundary markers: Absent. The skill does not provide delimiters or instructions to the agent to treat file content purely as data, leaving it vulnerable to instructions embedded in code or comments.
Capability inventory: The delegated codex tool has high-privilege access, including the ability to read all files and perform write operations (--sandbox writable) across the repository.
Sanitization: Absent. Codebase content is passed directly to the external AI agent for processing without any sanitization or boundary enforcement.

claude-code-codex-delegation