The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill relies on a pre-installed external CLI tool named codex. This is not a standard or officially recognized tool from OpenAI, and its behavior cannot be verified. Executing unverified third-party binaries is a high-risk activity that can lead to system compromise.
[METADATA_POISONING]: The skill's description and instructions reference non-existent models such as 'GPT-5.4' and 'gpt-5.3-codex'. These deceptive claims may be intended to trick the agent or user into trusting the tool's capabilities and safety.
[PRIVILEGE_ESCALATION]: The instructions encourage the use of the --full-auto flag, which enables 'auto-approval of file writes.' This bypasses standard user intervention and approval workflows for file system modifications. Furthermore, the skill mentions a --dangerously-bypass-approvals-and-sandbox flag, which, although advised against, indicates the tool possesses capabilities to completely escape security constraints.
[DYNAMIC_EXECUTION]: The workflow directs the agent to run codex exec to generate implementation code and then immediately 'Run tests/linting to validate quality.' This sequence results in the execution of code generated by an untrusted external tool, providing a direct mechanism for arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect injection as it ingests project files and user prompts without sanitization or boundary markers. These inputs are passed to a tool with file-write and execution capabilities, creating a significant attack surface where malicious data could trigger dangerous agent behaviors.

codex