The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions in SKILL.md explicitly direct the agent to 'immediately retry' a failed command 'with escalated permissions' while omitting the requirement to 'ask the user to run it yet'. This pattern aims to bypass standard permission barriers and user confirmation prompts.
[COMMAND_EXECUTION]: The agent is instructed to run platform-level installation commands (codex mcp add) for external MCP servers. The skill provides a specific URL for this installation and directs the agent to handle failures by attempting to elevate its own execution context.
[METADATA_POISONING]: The skill provides extensive, formatted guidance for fictional models and APIs such as 'GPT-5.4', 'gpt-oss-120b', and 'Sora-2'. Presenting non-existent products as current and 'official' documentation is deceptive and can lead to architectural and security misjudgments by the user.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from a remote MCP documentation server, creating a pathway for third-party controlled content to influence agent instructions.
Ingestion points: Content fetched via mcp__openaiDeveloperDocs__fetch_openai_doc as noted in SKILL.md.
Boundary markers: The instructions lack delimiters or warnings to treat external documentation as untrusted data.
Capability inventory: The skill possesses capabilities for file-system access (via references/ files) and execution of system-level commands.
Sanitization: There are no instructions or mechanisms identified to sanitize the content returned by the remote MCP server before use.

openai-docs