The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/imagegen_cli.py reads a sensitive local credential file located at ~/.codex/auth.json (or a path specified by the CODEX_HOME environment variable) which contains OAuth access and refresh tokens. These tokens, along with user-provided local image files passed via the --reference flag, are transmitted to OpenAI's authentication and chat backend servers (auth.openai.com and chatgpt.com). This behavior is required for the skill to function as an image generator using an existing subscription but involves the handling and transmission of sensitive credentials and local user data to external endpoints.
[PROMPT_INJECTION]: The skill presents a vulnerability surface for indirect prompt injection by accepting user-supplied text and images that are directly incorporated into the instructions sent to the image generation model.
Ingestion points: Prompt text provided via the --prompt or --prompt-file arguments and local image data provided via the --reference flag in scripts/imagegen_cli.py.
Boundary markers: No specific delimiters or boundary markers are used to isolate user-provided content in the API payload, nor are there instructions to the model to ignore embedded malicious commands.
Capability inventory: The skill possesses the capability to perform authenticated network requests to OpenAI and read files from the local filesystem.
Sanitization: No input sanitization, filtering, or validation is performed on the prompt content or reference image data before transmission to the backend API.

imagegen