The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions specifically targeting the agent's identity ("If you are Codex... stop reading and proceed however you otherwise would"), which represents an attempt to bypass standard instruction processing based on the model's self-identification.
[COMMAND_EXECUTION]: The skill relies on shell command invocation to interact with the codex CLI. The provided execution templates place user-provided prompts within double quotes. If the calling agent does not properly escape these inputs, the command may be vulnerable to shell injection.
[COMMAND_EXECUTION]: The instructions recommend redirecting error output to the null device (2>/dev/null). This concealment pattern suppresses diagnostic information and could hide failed execution attempts or unexpected behaviors from the user's oversight.
[DATA_EXFILTRATION]: The skill facilitates the transmission of codebase context and prompts to external OpenAI models for processing. This involves sending local repository data to a well-known remote service provider.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read the final results from a local file (/tmp/codex-out.txt) produced by an external agent. This output is untrusted and could contain adversarial instructions intended to influence the calling agent's subsequent logic.
Ingestion points: Instructions in SKILL.md to read the task result from the /tmp/codex-out.txt file after execution.
Boundary markers: The skill does not provide delimiters or instructions to treat the external agent's output as an untrusted data block.
Capability inventory: The agent has the capability to execute shell commands (codex exec) and perform file system operations.
Sanitization: The skill lacks instructions for validating, filtering, or sanitizing the content returned by the external service before it enters the agent's context.

use-codex