The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents the codex plugin marketplace add <source> command in references/cli-reference.md, which allows installing plugins from arbitrary GitHub repositories, Git URLs, or local paths. This introduces a supply chain risk through unverified third-party code.
[REMOTE_CODE_EXECUTION]: The codex mcp add command allows the registration of arbitrary shell commands as MCP servers. This enables the execution of persistent background processes based on potentially untrusted model-generated instructions or user inputs.
[CREDENTIALS_UNSAFE]: The skill provides explicit instructions for handling sensitive credentials in SKILL.md, including codex login --with-api-key which reads API keys from standard input, and codex mcp add ... --bearer-token-env-var GITHUB_TOKEN for managing GitHub tokens.
[COMMAND_EXECUTION]: The skill utilizes the codex exec utility to run model-generated commands. While it mentions sandboxing, it also documents the --dangerously-bypass-approvals-and-sandbox (alias --yolo) and danger-full-access flags in SKILL.md and references/cli-reference.md, which completely disable security constraints.
[DATA_EXFILTRATION]: The skill supports registering remote MCP servers via URLs (e.g., codex mcp add <name> --url https://...). This provides a mechanism where local context or files could be sent to an external, untrusted endpoint controlled by a third party.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection (Category 8).
Ingestion points: Processes untrusted data from stdin, git diff outputs, and local files (e.g., src/auth/*.ts) as shown in SKILL.md examples.
Boundary markers: No explicit sanitization or markers are used to separate user data from instructions.
Capability inventory: Possesses powerful capabilities via codex exec, including file writing (workspace-write) and arbitrary command execution.
Sanitization: Lacks evidence of input validation or escaping before passing data to the model.

codex-cli