The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/gpt-image2.mjs is designed to extract sensitive credentials from the local filesystem. It specifically targets ~/.codex/auth.json to retrieve the OPENAI_API_KEY and ~/.codex/config.toml for base URL settings. This automated harvesting of credentials from other applications' configuration directories is a significant security risk.
[DATA_EXFILTRATION]: Retreived API keys are transmitted in the Authorization header of HTTP POST requests to a remote base URL. Although the base URL is configurable, the pattern of reading local secrets and sending them over the network creates a direct path for credential exfiltration to untrusted domains if the configuration is influenced by malicious instructions.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect injection by processing untrusted data from both the user and external tool outputs.
Ingestion points: User-provided image prompts and image URLs returned from the remote image generation service in scripts/gpt-image2.mjs.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill possesses network communication capabilities (fetch) and filesystem write permissions (fs.writeFile), which could be abused if the agent is influenced by malicious data.
Sanitization: The script performs basic MIME type validation using magic numbers for downloaded images but does not sanitize the metadata or content of the data retrieved from the remote service.

gpt-image2