The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates as a manager that integrates reports and results from subagents and separate threads into a central mission ledger. This ingestion of content from other agent contexts creates a standard surface for indirect prompt injection, where a subagent could potentially influence the manager's behavior.
Ingestion points: Integrated reports from the worker-reports/ directory and feedback from separate threads.
Boundary markers: The skill mandates the use of a "Worker Prompt Pattern" and "Handoff Contract" to structure communication and limit the scope of delegated work.
Capability inventory: The manager can spawn new agents, write to the file system (ledgers, handoffs), and execute the local start_mission.py script.
Sanitization: The instructions emphasize the use of compact summaries and links over pasting raw logs, which naturally reduces the risk of malicious instruction injection.
[COMMAND_EXECUTION]: The skill utilizes a local Python script (scripts/start_mission.py) to initialize mission workspaces. Analysis of the script confirms it is restricted to benign file system operations, such as creating directories and writing a markdown ledger from a template. It does not perform network operations or utilize unsafe dynamic execution patterns.
[DATA_EXPOSURE]: The skill instructions mention checking ~/.codex/config.toml to verify if multi-agent features are enabled in the host environment. This is a routine configuration check for the specific tool and does not target sensitive system credentials or personal user data.

codex-mission-control