The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs users to download and execute code from an external source via high-risk shell pipes. This includes curl -fsSL https://raw.githubusercontent.com/b-nnett/codex-plusplus/main/install.sh | bash for Unix-based systems and irm https://raw.githubusercontent.com/b-nnett/codex-plusplus/main/install.ps1 | iex for Windows.
[COMMAND_EXECUTION]: The skill facilitates extensive interaction with the local shell to install, repair, and update the tweak system, including commands like codexplusplus install, codexplusplus update, and recursive directory deletion using rm -rf for troubleshooting.
[PRIVILEGE_ESCALATION]: The skill includes instructions to bypass macOS Gatekeeper security protections using the xattr -cr /Applications/Codex.app command and describes patching the app.asar binary, which compromises the integrity of the installed application.
[DYNAMIC_EXECUTION]: The skill is centered around a runtime that patches a desktop application to discover and execute ESM modules (tweaks) with full Electron renderer privileges. This allows for the runtime injection and execution of code not originally packaged with the application.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where instructions processed from external 'tweak' manifests or scripts could influence agent behavior or lead to malicious outcomes.
Ingestion points: Tweak directories such as ~/Library/Application Support/codex-plusplus/tweaks/ where the agent reads manifests and code.
Boundary markers: None; the skill does not provide clear delimiters or warnings for the agent to ignore potentially malicious instructions inside third-party tweaks.
Capability inventory: Binary patching, shell command execution, file system modification, and execution of arbitrary JavaScript/TypeScript code.
Sanitization: There is no documented validation or sanitization process for the contents of the tweaks before they are executed in the Electron environment.

codex-plusplus-tweak-system