The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands by piping prompts into the codex CLI (e.g., echo "prompt" | codex exec). This pattern is vulnerable to shell command injection if the prompt content is not strictly sanitized, as strings containing double quotes or shell metacharacters could escape the intended command context.
[COMMAND_EXECUTION]: It encourages the use of the --sandbox danger-full-access flag, which the documentation explicitly states permits "network or broad access." This represents a high-risk capability that could be exploited for data exfiltration or unauthorized system modification.
[PROMPT_INJECTION]: The skill contains references to non-existent and fictitious AI models, such as gpt-5.5, gpt-5.4, and gpt-5.3-codex-spark. This is a deceptive practice that may be intended to trick the agent into hallucinating capabilities or bypassing safety constraints by assuming the persona of an unrestricted "future" model.
[PROMPT_INJECTION]: The guide instructs the agent to adopt a specific persona ("Identify yourself as Claude") and engage in role-play when interacting with the external tool. This is a common prompt injection technique used to manipulate the behavior of AI systems.
[COMMAND_EXECUTION]: The instructions mandate the use of 2>/dev/null by default to suppress thinking tokens and error output. This lack of transparency hides potential warning signs, errors, or evidence of malicious activity from the user.

codex