The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_codex.py invokes the codex command-line tool and other local runner scripts using subprocess.run. The implementation correctly uses a list-based command structure rather than a raw shell string, which is a standard safety measure to prevent shell injection attacks.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection (Category 8).
Ingestion points: Untrusted data enters the agent context through the prompt, prompt_file, and session_file arguments in scripts/run_codex.py.
Boundary markers: The skill concatenates these inputs using simple newlines. It does not use XML tags, delimiters, or explicit instructions to the target model to ignore potentially malicious instructions embedded within the ingested files.
Capability inventory: The generated prompt is processed by codex exec, which defaults to --full-auto mode. This gives the model the capability to execute code and modify the system based on potentially poisoned instructions.
Sanitization: There is no sanitization, escaping, or validation of the content read from the provided file paths.

codex-runner