The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary purpose is to invoke codeagent-wrapper, which facilitates broad file system access and shell command execution via agent presets like develop.
[DYNAMIC_EXECUTION]: The environment variable CODEX_BYPASS_SANDBOX is set to true by default. This disables the execution sandbox for the Codex backend, allowing code generated by the AI to run with the full privileges of the current user session without isolation.
[INDIRECT_PROMPT_INJECTION]: The skill implements an auto-detection mechanism that reads local project files to inject specific "skills" (instruction sets) from ~/.claude/skills/ into the agent's prompt. This creates a vulnerability surface where a malicious project could influence agent behavior by triggering specific skill injections.
Ingestion points: Files like package.json, go.mod, Cargo.toml, pyproject.toml, and setup.py in the working directory.
Boundary markers: None specified for injected skills.
Capability inventory: Bash, Read, and Write capabilities are available to agents, allowing them to modify the system.
Sanitization: No evidence of sanitization for injected skill content or project file names.
[COMMAND_EXECUTION]: The --skip-permissions flag and the CODEAGENT_SKIP_PERMISSIONS=true environment variable are used to suppress user confirmation prompts when the Claude backend attempts to execute tools, reducing human-in-the-loop oversight for sensitive operations.

codeagent