The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an untrusted source: https://github.com/Jia-Ethan/codex-keysmith.git.
[COMMAND_EXECUTION]: Users are prompted to execute a downloaded Python script (codex-instruct.py) which performs file system modifications. While the documentation claims it uses only standard libraries, the code is unvetted and originates from a third party.
[PROMPT_INJECTION]: The skill distributes a 'GPT-5.5 unrestricted-mode' instruction file. This is a known 'jailbreak' pattern intended to bypass the safety guardrails and behavior guidelines of large language models.
[INDIRECT_PROMPT_INJECTION]: This skill creates an attack surface for indirect prompt injection by configuring a model to follow instructions from a local Markdown file that could be modified by other processes or contain adversarial content.
Ingestion points: Reads ~/.codex/config.toml and potentially various .md files.
Boundary markers: No explicit mention of delimiters or instruction isolation in the configuration update process.
Capability inventory: Performs file writes (shutil.copy, os.write), directory auto-detection, and process termination (pkill).
Sanitization: Documentation claims path validation and filename filtering, but the effectiveness of these measures against adversarial input is unverified.
[COMMAND_EXECUTION]: The troubleshooting section suggests using pkill -9 codex, which is a forceful process termination command that can lead to data loss or system instability if misused.

codex-keysmith-instruction-installer