The Agent Skills Directory

[PROMPT_INJECTION]: The skill documents several mechanisms to bypass standard security boundaries and human-in-the-loop validation.
The --skip-permissions CLI flag and CODEAGENT_SKIP_PERMISSIONS environment variable are used to suppress interactive permission prompts when using the Claude backend, reducing user oversight of the agent's actions.
The CODEX_BYPASS_SANDBOX environment variable allows the agent to execute code without the default isolation provided by the Codex backend sandbox.
The documentation includes an example configuration for a 'develop' agent with yolo: true, which enables autonomous execution of tasks without interactive confirmation.
[PROMPT_INJECTION]: The skill's auto-detection logic presents a surface for indirect instruction injection from untrusted files.
Ingestion points: The tool automatically scans the working directory for manifest files like package.json, go.mod, and Cargo.toml to determine which skills to inject into the prompt.
Boundary markers: There are no delimiters or warnings to prevent the agent from following instructions embedded within these external project files.
Capability inventory: The agent has access to full shell execution (Bash) and file system modification through the codeagent-wrapper tool.
Sanitization: The skill does not describe any validation or sanitization process for the content of files used to trigger skill injections.
[COMMAND_EXECUTION]: The tool is designed to execute arbitrary system commands and dynamically generated code.
It utilizes a temporary directory defined by CODEAGENT_TMPDIR for storing and running executable scripts generated by the AI backends.
The 'develop' agent preset is explicitly granted permissions to use the 'Bash' tool for implementing code and running tests, which can lead to unrestricted command execution.
[DATA_EXFILTRATION]: The skill manages and reads sensitive local configuration data that could be exposed.
It reads agent presets and configurations from ~/.codeagent/models.json and ~/.codeagent/config.*, which may contain sensitive environment metadata.
Because the agent has both network access (via AI backends) and file read capabilities, these configurations are at risk of being transmitted to external servers if the agent is influenced by malicious input.

codeagent