The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from multiple sources and interpolates it directly into prompts for the Codex MCP tool.
Ingestion points: Project specification files (--spec), feature intent documentation (docs/features/), existing source code files, and external review findings are all used to build the context for implementation tasks.
Boundary markers: The skill uses markdown code blocks and headers to delimit context in the prompt templates found in references/codex-prompts.md. However, there are no explicit instructions to the AI to ignore instructions potentially embedded within those files.
Capability inventory: The skill calls the mcp__codex__codex tool with workspace-write capabilities and has access to the Bash tool, allowing for significant modifications to the local environment.
Sanitization: The prompt templates perform direct string interpolation (e.g., ${PROJECT_CONTEXT}, ${REVIEW_FINDINGS}) without sanitization, filtering, or escaping of the input content.
[DYNAMIC_EXECUTION]: The skill automates the creation and modification of source code by an AI model and subsequently triggers the execution of that code via project test commands (e.g., npm test). While this is the intended purpose of the skill, it represents a pattern where dynamically generated content is executed at runtime.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run unit and integration tests as well as git operations. The skill adheres to the principle of least privilege by restricting shell access to git:* commands in the frontmatter configuration.

codex-implement