The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a bash tool that allows the remote agent to execute shell commands on the local host. Although a 'safe mode' with an allowlist is provided, it can be bypassed or expanded by the user or through environment variables.
[REMOTE_CODE_EXECUTION]: Through the 'Handoff Mode,' the skill allows a remote LLM to write execution plans to a local file (.ai-bridge/current-plan.md) which are then automatically executed by a local watcher process (codexpro watch-handoff). This pattern effectively grants remote code execution capabilities to the AI agent.
[DATA_EXFILTRATION]: The skill facilitates the creation of public tunnels (via ngrok or Cloudflare) to expose the local Model Context Protocol (MCP) server. This channel is used to transmit repository content, file trees, and command outputs to the ChatGPT web interface.
[EXTERNAL_DOWNLOADS]: The installation process requires downloading the codexpro package from npm and suggests using external binary clients like cloudflared or ngrok to establish connectivity.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection because it ingests untrusted data from the local repository (e.g., source code, AGENTS.md, or documentation) and possesses high-privilege capabilities.
Ingestion points: The read, tree, and open_workspace tools read arbitrary files and project metadata from the workspace.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within read files are specified in the tool definitions.
Capability inventory: The skill possesses powerful capabilities including bash (shell execution), write (file creation), and edit (file modification).
Sanitization: There is no evidence of sanitization or filtering applied to the content of files before they are processed by the agent's context.

codexpro-chatgpt-local-agent