The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The SKILL.md file contains a 'Health Check' section that explicitly instructs the agent to run echo $OPENAI_API_KEY. If executed, this command will print the plaintext API key into the agent's output stream, exposing sensitive credentials to the user, logs, or downstream processes.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing a local script ./scripts/run_agent.py and a codex binary via shell commands. These executions incorporate user-provided instructions. While the skill claims to pipe input via stdin to avoid process listing exposure, the underlying script (run_agent.py) is not provided, making its input sanitization and command safety unverifiable.
[DATA_EXFILTRATION]: The skill is designed to read local file contents and transmit them to external OpenAI-compatible endpoints. Although this is the stated purpose, it establishes a functional path for exfiltrating sensitive local data if the agent is directed to process unintended files.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection.
Ingestion points: The skill processes untrusted content from local files (e.g., target.py) specified as INPUT_FILE.
Boundary markers: There are no explicit delimiters or instructions provided to the sub-agent to ignore embedded commands within the ingested data.
Capability inventory: The agent is granted Bash, Read, and Write tools, and it routinely executes shell commands.
Sanitization: There is no evidence of sanitization or filtering of the external file content before it is processed by the model.

codex-cli-agent