The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run and subprocess.Popen to interact with local system tools including ps, lsof, codex, and claude. These calls are used for process discovery, liveness checking, and message queueing within the local host environment.
[PERSISTENCE]: The install-hook subcommand modifies the local ~/.codex/hooks.json file to add a SessionStart hook. This ensures that the messaging shims are automatically restarted whenever a new Codex session begins. The implementation includes safety checks, such as backing up the original configuration and using a TOML parser (when available) to verify that only the intended keys are modified.
[INDIRECT_PROMPT_INJECTION]: As an inter-agent bridge, the skill ingests data from one AI agent (Codex) and delivers it to another (Claude).
Ingestion points: RolloutTail.poll() reads Codex rollout JSONL files; Shim._handle_connection reads from Claude's Unix socket.
Boundary markers: Messages are delimited using a specific [session-peers ...] tag line and an XML-like <cross-session-message> wrapper.
Capability inventory: Local command execution (subprocess), Unix socket communication, and file system writes (state and registry files).
Sanitization: The script includes a neutralise_wrapper_markup function that replaces the < character with a homoglyph-like ‹ to prevent messages from breaking out of the XML wrapper. It also uses standard XML attribute escaping and a REPLY_BUDGET to prevent automated infinite loops between agents.
[CREDENTIALS_UNSAFE]: The skill reads Claude's local peerToken from the ~/.claude/sessions/ directory. These tokens are used locally to authenticate the shim's connection to the Claude messaging socket and are not transmitted to any external services.

session-peers