The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for installing additional capabilities from remote URLs using the codex skill install command. While one example uses a vendor-related domain, another references an unknown domain (example.com), which could lead to the execution of untrusted instructions or scripts.
[DYNAMIC_EXECUTION]: The skill demonstrates generating executable shell scripts in the .codex/hooks/ directory (e.g., pre-approve.sh, post-approve.sh) and modifying their permissions with chmod +x to enable automatic execution during the project workflow.
[COMMAND_EXECUTION]: The documented tool includes a /sh command that allows for arbitrary shell command execution within the agent's environment. It also describes a 'Computer Use' feature that allows the agent to control the user's desktop environment and browser.
[PERSISTENCE]: The skill documents persistence mechanisms including /automation for creating scheduled tasks (cron-like) and the use of hooks that execute automatically on project events.
[PRIVILEGE_ESCALATION]: The instructions include the use of chmod +x to grant execution permissions to dynamically created script files.
[EXTERNAL_DOWNLOADS]: The skill describes downloading external components via npx (e.g., @modelcontextprotocol/server-github) and Docker, as well as installing desktop and browser extensions from remote servers.
[INDIRECT_PROMPT_INJECTION]: The skill describes functionality for reading untrusted data from external sources, including web scraping via a Chrome extension and processing instructions from external skill files, which could be exploited to influence agent behavior.
Ingestion points: External URLs via skill install, web page content via Chrome extension, and local AGENTS.md project configuration files.
Boundary markers: None explicitly described for the ingestion and execution of remote skill content.
Capability inventory: File system access (read/write), shell command execution (/sh), task scheduling (/automation), and browser control ('Computer Use').
Sanitization: None described for external skill content or web scraping output.

codex-orange-book-guide