The Agent Skills Directory

[METADATA_POISONING]: The skill contains extensive deceptive claims about utilizing "GPT-5.2" and "GPT-5.1-thinking" models, including specific performance metrics like "76.3% SWE-bench" and "September 30, 2024" knowledge cutoffs. These models are not currently officially recognized or publicly available, suggesting the metadata is intended to mislead the agent or users regarding the skill's actual capabilities and the underlying technology.
[OBFUSCATION]: The instructions explicitly direct the agent to append 2>/dev/null to all codex exec commands to suppress thinking tokens (stderr). While the stated purpose is to reduce context window usage, this technique effectively hides error messages, warnings, and potential evidence of malicious execution from the user and the agent's monitoring.
[INDIRECT_PROMPT_INJECTION]: The skill is primarily designed to analyze external code repositories, which serves as a major ingestion point for untrusted data. It lacks safety measures to prevent the agent from acting on instructions embedded within the code it processes.
Ingestion points: External code repositories and session data processed via codex exec and codex resume (SKILL.md).
Boundary markers: None identified; instructions do not tell the agent to distinguish between its rules and instructions found in analyzed files.
Capability inventory: The skill can execute arbitrary shell commands via the codex CLI and has file-writing capabilities through --sandbox workspace-write and --sandbox danger-full-access modes.
Sanitization: There is no mention of escaping, validating, or filtering the content ingested from external repositories before it influences the agent's actions.
[EXTERNAL_DOWNLOADS]: The README.md provides installation instructions that require cloning a repository from an unverified GitHub organization (skills-directory). This introduces a supply chain risk, as the source and contents of the skill and the associated CLI tool are not from a trusted vendor.
[COMMAND_EXECUTION]: The skill patterns involve piping user-provided strings directly into shell commands (e.g., echo "prompt" | codex exec). This pattern creates a risk of command injection if the underlying CLI tool or the shell environment does not properly sanitize the input strings.

codex