The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone and execute code from an untrusted GitHub repository (0xSero/codex-shim) which is not associated with the skill author or a known trusted organization.
[PRIVILEGE_ESCALATION]: The instructions for the "macOS Picker Patch" require extensive use of sudo to modify files within the /Applications/Codex.app bundle, bypass integrity checks, and re-sign application binaries. This grants the skill-provided code high-level permissions over a system application.
[CREDENTIALS_UNSAFE]: The skill manages and accesses highly sensitive credentials, including OpenAI, Anthropic, and DeepSeek API keys, as well as ChatGPT access tokens stored in ~/.codex/auth.json. The proxying of these tokens through untrusted code represents a significant risk of credential exposure.
[DYNAMIC_EXECUTION]: The skill uses asar extraction and sed to dynamically modify Javascript assets within a production application's archive. It also includes a Python snippet to recompute hash values specifically to bypass Electron's built-in ASAR integrity checks.
[COMMAND_EXECUTION]: The installation process symlinks external binaries (codex-shim, codex-app, codex-model) from an untrusted source into the user's path, providing a mechanism for arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests data from external model endpoints (OpenAI, Anthropic, DeepSeek, OpenRouter) and translates them into the Codex context (SKILL.md).
Boundary markers: No explicit boundary markers or instruction-ignoring delimiters are defined for handling the external model responses.
Capability inventory: The skill possesses command execution capabilities via the codex-shim CLI tools to interact with the local environment (SKILL.md).
Sanitization: There is no evidence of sanitization or validation of the external API content before it is processed and returned to the agent context.

codex-shim-byok-models