The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to interact with local memory and configuration files in the user's home directory (~/.codex). While these files contain potentially sensitive user data, the skill includes a dedicated risk scanner (scripts/scan-memory-risks.mjs) that automatically redacts credentials, tokens, and private keys before they are presented to the agent or saved in reports. Access is strictly local and no network exfiltration was found.
[COMMAND_EXECUTION]: The workflow relies on three local Node.js scripts for its operations. These scripts are implemented using only the Node.js standard library and include advanced safety features. For example, backup-memories.mjs uses file descriptor stat verification to prevent Time-of-Check to Time-of-Use (TOCTOU) attacks, enforces the O_NOFOLLOW flag to block symbolic link exploitation, and calculates SHA-256 hashes to ensure the integrity of backups.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from previously stored memories, creating a surface for indirect prompt injection. This risk is mitigated by the skill's architecture, which requires the agent to decompose content into atomic claims and verify them against live repository evidence. The workflow also mandates explicit user approval for any changes and uses predefined templates to maintain strict output boundaries.
[PRIVILEGE_ESCALATION]: The backup scripts implement secure file permissions (e.g., chmod 700 for directories and chmod 600 for files) to ensure that the data remains accessible only to the owner. It also includes logic to verify that backup locations are outside of version-controlled worktrees to prevent accidental exposure via Git.

codex-memory-curator