The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to manually construct and execute a shell command using the codex CLI tool.
Evidence: Step 4 provides a template: codex exec ${CODEX_MODEL:+--model=$CODEX_MODEL} --sandbox read-only -c model_reasoning_effort="xhigh" -c stream_idle_timeout_ms=600000 "prompt here" < /dev/null.
Risk: If the strings interpolated into the prompt are not correctly escaped, it creates a vector for shell command injection.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly directs the external analysis tool to read and obey instructions from project configuration files that may be untrusted.
Ingestion points: CLAUDE.md, CLAUDE.local.md, .claude/rules/, and ~/.claude/CLAUDE.md (via Step 3's memory-load preamble).
Boundary markers: Absent; instructions simply tell Codex to "read these project guidance files."
Capability inventory: The codex exec command (Bash tool) with full project read access.
Sanitization: Absent; file content is processed as instructions.
[DATA_EXFILTRATION]: The skill is designed to transmit project context to an external service provider.
Evidence: The workflow involves gathering "relevant files, error messages, behavior observed" and sending them to the codex CLI, which communicates with OpenAI's API.
Risk: Sensitive code or internal project structure could be exposed to the third-party service.
[EXTERNAL_DOWNLOADS]: The skill documentation encourages the installation of an external third-party package.
Evidence: The Troubleshooting section specifies: npm install -g @openai/codex.

ask-codex