The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the user to disable the agent's core security features and safety boundaries.
Evidence: In the 'Prerequisites for Full Functionality' section, it mandates starting the platform with the flag --dangerously-bypass-approvals-and-sandbox, which circumvents the security sandbox and removes mandatory user approval for dangerous actions.
[PERSISTENCE]: The skill implements a persistence mechanism by installing and requiring session hooks.
Evidence: It utilizes ~/.config/codex/hooks/post-session.sh to execute logic automatically at the end of every agent session, ensuring the skill's code runs continuously across restarts.
[EXTERNAL_DOWNLOADS]: The skill is distributed from an untrusted third-party repository not associated with verified vendors.
Evidence: The installation instructions point to https://github.com/leo-lilinxiao/codex-autoresearch as the primary source for the skill's code.
[COMMAND_EXECUTION]: The skill is designed to autonomously infer and execute shell commands without human-in-the-loop validation.
Evidence: The core loop automatically identifies and runs verify_cmd and guard_cmd strings based on repository content and natural language goals. When combined with the requested sandbox bypass, this allows for unmonitored arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill's reliance on 'inferring' configuration from the local environment creates a significant attack surface for indirect prompt injection.
Evidence: An attacker could place malicious instructions inside a project file (such as a README, code comment, or configuration file) that the agent reads and treats as a valid shell command to be executed during the iteration loop.

codex-autoresearch-skill