The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses unsafe shell interpolation when invoking the Codex CLI. Specifically, the command codex exec -s read-only "$(cat "$REPO_TMP/img-prompt.txt")" evaluates the content of the prompt file within double quotes. If the prompt contains shell metacharacters such as backticks, semicolons, or double quotes, it could allow an attacker to break out of the intended command and execute arbitrary code on the host system.
[DATA_EXFILTRATION]: The skill and its accompanying script (scripts/extract-codex-image.py) access the ~/.codex/sessions/ directory to read session rollout logs. These files contain the history of agent interactions and session rollouts, which may include sensitive user data, system context, or credentials that are not intended for extraction.
[INDIRECT_PROMPT_INJECTION]: * Ingestion points: The skill accepts text prompts for image generation from the agent context (SKILL.md, Step 1). * Boundary markers: None. The prompt is written directly to a file and then passed to the execution tool without delimiters or safety warnings. * Capability inventory: The skill can execute shell commands (codex, sips, python3), write to the repository, and read from the user's home directory. * Sanitization: There is no evidence of validation or sanitization of the input prompt before it is used in shell commands.
[PRIVILEGE_ESCALATION]: The documentation explicitly mentions the --dangerously-bypass-approvals-and-sandbox flag for the codex CLI. While intended as technical context, it documents a mechanism for bypassing the security controls and sandboxing features of the Codex execution environment.

generate-image