The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions specifically direct the agent to override security restrictions by passing -c sandbox_workspace_write.network_access=true and -s workspace-write to the codex command. This grants the sub-process capabilities that are typically restricted in a secure sandbox, such as outbound network communication and file system modification.
[INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect injection.
Ingestion points: Processes 'uncommitted changes' from the local repository and the current conversation context to construct prompts for the Codex CLI.
Boundary markers: None identified. The skill uses basic markdown headers but lacks strict delimiters or system-level instructions to ignore embedded commands in the code being reviewed.
Capability inventory: The generated prompt is executed via the codex CLI with full network and write access enabled.
Sanitization: There is no evidence of sanitization or escaping of the ingested code or context before it is written to the prompt.md file used for execution.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute the codex binary with various flags and redirects (codex exec ... < /path/to/prompt.md). The input to this command is dynamically generated based on user requests and local file content.
[DYNAMIC_EXECUTION]: The agent is instructed to write a prompt containing potentially untrusted data to a temporary file (prompt.md) outside the worktree and then use that file as input for the codex executor. This pattern of generating executable-like content at runtime and piping it into a powerful CLI tool presents a risk if the input content is manipulated.

codex-consultation