The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to manage and execute shell commands through the omx CLI. Triggers and documentation provide examples of running setup scripts, execution loops, and parallel agent teams using tools like tmux.
[EXTERNAL_DOWNLOADS]: The installation and update procedures involve downloading and installing global packages from the NPM registry, specifically oh-my-codex and @openai/codex. These are documented as requirements for the workflow.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it incorporates external, potentially untrusted data into its reasoning and execution flow.
Ingestion points: Project-specific guidance files (e.g., AGENTS.md), implementation plan artifacts stored in .omx/plans/, and raw user prompts passed to the omx exec command.
Boundary markers: The skill uses delimiters like YAML frontmatter in skill files and HTML comments for merging project guidance, though these are primarily for organization rather than security isolation.
Capability inventory: The skill can execute arbitrary shell commands via the omx CLI and integrated tools like tmux as described throughout SKILL.md.
Sanitization: The provided documentation does not specify sanitization or validation logic for external inputs processed by the agent roles before they are passed to the execution engine.
[DYNAMIC_EXECUTION]: The skill utilizes native lifecycle hooks (.codex/hooks.json) and dynamically loaded agent roles and skills defined in markdown files to configure the execution environment and influence agent behavior at runtime.

oh-my-codex-workflow