The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Python subprocess module to execute local system utilities (ps, lsof, codex) for session discovery and message delivery. These calls use fixed argument lists, avoiding shell injection risks.
[PRIVILEGE_ESCALATION]: The skill implements least-privilege principles by enforcing 0600 permissions on state files and 0700 on directories. It also performs ownership and permission checks on Unix socket directories before use to prevent unauthorized access.
[DATA_EXFILTRATION]: Analysis confirmed that the skill does not perform any remote network operations. All data transfer is confined to local Unix domain sockets and the Codex command-line interface.
[PERSISTENCE]: The skill includes an optional mechanism to install a hook in the Codex configuration (hooks.json). This is a documented feature used to automatically attach the bridge when session threads start or resume.
[INDIRECT_PROMPT_INJECTION]: The script sanitizes message content by substituting XML-like characters to prevent the manipulation of session-peers control tags. It also uses specific wrappers to isolate peer messages from the agent's internal instructions.
[DYNAMIC_EXECUTION]: The script uses a standard daemonization pattern involving os.fork and os.execv to run the session shim in the background. This execution is limited to self-referential calls of the skill's own script.

session-peers