The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the codex CLI and potentially other local runner scripts (as fallbacks) using subprocess.run. Evidence:
In scripts/run_codex.py, the _run_codex and invoke_fallback functions construct command lists and pass them to subprocess.run.
The script uses shlex.quote to escape arguments when generating command display strings, and passes arguments as a list to subprocess.run to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of prompts and external files, which are then passed to the Codex CLI for execution.
Ingestion points: Untrusted data enters the agent context through the prompt argument, --prompt-file, and --session-file inputs in scripts/run_codex.py.
Boundary markers: The skill implements several isolation mechanisms, including read-only and workspace-write sandboxes, and a repo_read_only tool profile that disables plugins, apps, and MCP servers.
Capability inventory: The skill has the capability to execute shell commands via the Codex CLI and can write to the filesystem if the user explicitly authorizes it via flags like --allow-write or --full-auto.
Sanitization: CLI arguments are handled via list-based subprocess calls to avoid shell parsing. The skill also supports enforcing output structure via JSON schema validation (--output-schema) to ensure model responses adhere to an expected format.

codex-runner