The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to construct shell commands using raw user-provided strings (e.g., codex exec ... "your prompt here" or echo "your prompt here" | codex exec ...). If the agent fails to properly escape shell metacharacters in the user input, it creates a direct path for arbitrary command injection on the host system.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The codex tool ingests untrusted user prompts and workspace files for analysis and automated editing (SKILL.md).
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when passing data to the tool.
Capability inventory: The skill provides access to workspace-write (modifying local files) and danger-full-access (network and broad system access) through the codex CLI (SKILL.md).
Sanitization: Absent. There are no instructions to sanitize, escape, or filter the content of the user prompt or the files being analyzed.
[PRIVILEGE_ESCALATION]: The skill defines a high-privilege execution mode via the --sandbox danger-full-access flag, which explicitly permits network access and broad system permissions. While the skill includes a directive to ask for user permission before using 'high-impact flags,' the presence of this capability increases the attack surface.
[METADATA_POISONING]: The skill references non-existent and deceptive model names such as gpt-6-astra and gpt-5.6-sol. Instructing an agent to use these fictitious identifiers as valid CLI options can lead to model hallucination, misleading the agent about its current capabilities or the environment it is operating in.

codex