The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates primarily by generating and executing shell commands through the codex CLI tool. It uses variable interpolation for prompts, output paths, and working directories.
[DATA_EXFILTRATION]: Local project data, including source code files and git diff outputs, is sent to an external service (OpenAI) via the codex exec command. Although this is the primary purpose of the skill, it represents a data transmission vector that users should monitor for sensitive information.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from the repository (e.g., code comments or documentation containing instructions) and feeds it into an LLM for analysis.
Ingestion points: Shell output from git diff and file contents referenced using the @ prefix in prompts.
Boundary markers: The instructions recommend using printf '%s' with single-quoted literals to prevent the local shell from interpreting the prompt content, though this does not stop the remote model from being influenced by data within the files.
Capability inventory: The skill uses the shell to execute codex, which has access to read the filesystem and communicate over the network.
Sanitization: The skill advocates for specific shell escaping techniques to handle special characters and prevent local command injection during prompt construction.

ask-codex