The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes workflows that ingest untrusted data from external sources into an AI-driven CLI tool without explicit sanitization.
Ingestion Points: The GitHub Action workflow in SKILL.md passes task descriptions derived from GitHub issue content to the codex tool via the -q parameter.
Capability Inventory: The tools described (codex, claude) have extensive capabilities, including reading/writing files, executing shell commands, and managing Git repositories/Pull Requests.
Boundary Markers: The workflow examples lack delimiters or instructions to ignore potential commands embedded within the GitHub issue content.
Sanitization: No input validation or filtering is performed on the issue data before it is processed by the AI.
[COMMAND_EXECUTION]: The orchestration patterns encourage the use of autonomous execution modes that bypass human review.
Evidence: Multiple examples in SKILL.md (GitHub Actions and the batch-codex-tasks.sh script) utilize the --approval-mode full-auto flag for the codex CLI.
Risk: This configuration allows an AI agent to perform persistent changes to the filesystem and repository based on generated instructions, which significantly increases the impact of a successful prompt injection attack.

codex-orchestration