The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes extensive bash commands to manage the development environment, including git operations like git rev-parse, git checkout, git worktree, and git merge, as well as directory creation and command availability checks.
[REMOTE_CODE_EXECUTION]: The skill dynamically generates JavaScript workflow files (.workflow.js) at runtime and executes them using the omega run command. It also executes dynamically constructed Python code via python3 - to process JSON data and persist run states.
[EXTERNAL_DOWNLOADS]: The skill prompts the user to perform global installations of external Node.js packages (@openai/codex and omegacode). It also suggests using sudo for these installations if necessary, which is a privilege escalation concern.
[CREDENTIALS_UNSAFE]: The skill performs checks for sensitive authentication files and environment variables, specifically verifying the existence of ~/.codex/auth.json, CODEX_API_KEY, and OPENAI_API_KEY during its preflight phase.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by reading project-level documentation (such as CLAUDE.md, AGENTS.md, and spec docs) and interpolating their contents into a "task brief" that is subsequently executed by an external AI agent.
Ingestion points: Reads files like CLAUDE.md, AGENTS.md, and project-specific documentation in Step 2.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when including external file content in the brief.
Capability inventory: The system has capabilities to write to the workspace (workspace-write sandbox) and execute project-defined test and lint commands.
Sanitization: There is no evidence of sanitization or filtering of the content read from external documentation files before interpolation.

codex-dev