The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the interpolation of user-supplied TOPIC and CONSTRAINTS into the research agent's prompt. A malicious user could craft inputs to override instructions or attempt to access unintended files within the allowed directory scope.\n
Ingestion points: Variable placeholders ${TOPIC} and ${CONSTRAINTS} in SKILL.md and references/techniques.md.\n
Boundary markers: The skill uses basic Markdown headers (e.g., ## Topic) as delimiters, which do not provide robust isolation for untrusted content.\n
Capability inventory: The research tool environment includes file system enumeration (ls, find), code searching (Grep), and file reading (Read).\n
Sanitization: There is no evidence of input validation, escaping, or filtering of the external topic content before it is processed by the AI researcher.\n- [SAFE]: The mcp__codex__codex tool is explicitly configured with a read-only sandbox setting, which effectively mitigates the risk of unauthorized file system modifications during the research phase.

codex-brainstorm