The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted third-party data (such as diffs, file contents, and feedback) by routing it through the autonomous codex agent.
Ingestion points: External text is ingested via the Bash tool using cat context.txt | codex exec ... or cat prompt.txt | codex exec ... (SKILL.md, lines 17, 24, 69).
Boundary markers: The skill suggests using XML tags like <task> and <structured_output_contract> to structure the prompt (SKILL.md, lines 102-110), but these are for the benefit of the codex model, not a security boundary against injection.
Capability inventory: The codex agent possesses high-privilege capabilities including file editing (workspace-write) and system-level operations like package installation (danger-full-access) (SKILL.md, line 92).
Sanitization: Instructions recommend manual shell escaping for backticks, dollar signs, and double quotes to prevent host-level command injection during prompt preparation (SKILL.md, lines 21-23), but do not sanitize the content processed by the codex LLM.
[PRIVILEGE_ESCALATION]: The skill instructs the agent to explicitly request high-privilege environments to function.
Sandbox Bypass: All codex calls are instructed to require dangerouslyDisableSandbox: true to bypass platform-level network restrictions (SKILL.md, line 27).
High-Privilege Flags: The skill documentation directs the agent to use --sandbox danger-full-access for tasks involving package installation, testing, and system operations (SKILL.md, line 92).
[COMMAND_EXECUTION]: The skill facilitates the execution of complex shell commands via the codex CLI, providing specific patterns to manage execution behavior.
Safety Bypass: The skill mandates the use of the --skip-git-repo-check flag for all invocations to bypass codex's internal safety requirement for trusted git directories (SKILL.md, line 31).
Execution Control: It provides instructions for redirecting stdin (< /dev/null) and using pipes to manage non-TTY hangs and large context inputs (SKILL.md, lines 13-17).
[DATA_EXFILTRATION]: The skill provides instructions for accessing sensitive local session data.
Session Exposure: The agent is instructed to recover lost session IDs by searching through rollout logs in ~/.codex/sessions/ (SKILL.md, line 79). These logs contain the full history of commands and outputs from previous tasks, representing a significant data exposure surface.

codex-exec