The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the codex CLI via a wrapper script (scripts/codex-session.sh) to perform implementation and auditing tasks. This enables the agent to execute complex, multi-turn logic outside of its own runtime environment.
[PRIVILEGE_ESCALATION]: The skill provides an interface to the danger-full-access sandbox mode in Codex. According to the README.md and SKILL.md, this mode removes all sandboxing and approval requirements, effectively granting the subagent full system access. While the skill instructs the agent to obtain explicit user consent first, the presence of this capability increases the risk of privilege escalation if the agent is compromised or fails to follow safety protocols.
[INDIRECT_PROMPT_INJECTION]: The skill processes project files by passing them to an external model (Codex) for analysis and editing.
Ingestion points: File contents read by codex exec within the local workspace as documented in SKILL.md.
Boundary markers: Absent. The skill does not employ delimiters or specific instructions to help the subagent distinguish between its instructions and potentially malicious content embedded in the data (e.g., in code comments).
Capability inventory: The subagent can write to the filesystem in workspace-write mode and execute arbitrary system commands in danger-full-access mode as seen in scripts/codex-session.sh.
Sanitization: Absent. Data from the filesystem is passed to the external model without filtering or sanitization.

codex-delegate