The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands such as mkdir, ls, mv, pgrep, ps, and sleep to manage files, directories, and timing within the ~/Downloads folder.
Evidence: Found in references/manage-actions.md, references/save-conversation.md, and references/codex-waiting.md for organizing downloaded artifacts and managing polling cycles.
Risk: Potential for command injection if the sanitization of external data, such as chat titles used in filenames, is bypassed.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of files, images, and reports directly from the ChatGPT web interface to the local filesystem using browser download events.
Evidence: Described in references/manage-actions.md and references/save-conversation.md.
[DATA_EXFILTRATION]: The skill has broad access to the user's browser environment, including active tabs, conversation history, memory, and project data.
Risk: Although instructed not to exfiltrate session data or cookies, the technical capability exists to read and transmit sensitive personal information accessed during the browser session.
[PROMPT_INJECTION]: The skill is exposed to indirect prompt injection as it ingests and processes text generated by ChatGPT, which may include content from untrusted websites or external applications.
Ingestion points: SKILL.md (browser control) and references/codex-waiting.md (reading <main> text).
Boundary markers: No explicit delimiters are used to separate ChatGPT output from agent instructions.
Capability inventory: Shell command execution, file writing, and background agent spawning.
Sanitization: Filename sanitization is performed using a regex-based replacement strategy.
[REMOTE_CODE_EXECUTION]: The skill dynamically loads JavaScript modules from the extension's local directory and uses the evaluate() function to run code within the browser's context.
Evidence: Found in references/codex-chrome-runtime.md using dynamic import() and tab.playwright.evaluate().
[REMOTE_CODE_EXECUTION]: The skill can spawn background agents to perform "heartbeat" monitoring of long-running tasks, creating a dynamic execution environment.
Evidence: Described in references/codex-waiting.md as a fallback mechanism for the Deep Research feature.

codex-chatgpt-skill