The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a plugin from an external, untrusted source (baskduf/FableCodex) using the codex plugin marketplace add command. This involves fetching third-party code that is not from a known trusted vendor.
[REMOTE_CODE_EXECUTION]: By adding the plugin via codex plugin add codex-fable5@fablecodex after downloading it from an untrusted source, the skill enables the execution of remote code on the local system.
[COMMAND_EXECUTION]: The workflow relies on the execution of shell commands for state management and task verification. The codex-fable5 tool specifically executes command strings provided via the --verify-cmd parameter.
[DYNAMIC_EXECUTION]: The skill implements dynamic execution by allowing arbitrary shell strings to be passed to and run by the codex-fable5 utility (e.g., codex-fable5 goals checkpoint --verify-cmd "..."). If these commands are generated based on untrusted task descriptions or external findings, they could be exploited.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data as "evidence" and "findings."
Ingestion points: Data enters the system via the --evidence flag in findings add and goals checkpoint commands, which is then stored in local .json files.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potentially malicious directions embedded within the evidence or finding descriptions.
Capability inventory: The skill has the capability to execute shell commands (--verify-cmd) and perform file system writes within the .codex-fable5/ directory.
Sanitization: There is no evidence of sanitization or validation of the content provided in these evidence fields before it is used to inform future agent actions or verification steps.

fablecodex-workflow