The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides patterns for delegating complex tasks to a CLI tool that executes shell commands and modifies the local file system.
Evidence: Examples using codex exec to perform refactoring, dependency updates, and feature implementation directly in the workspace.
[PRIVILEGE_ESCALATION]: The skill contains specific instructions on how to disable safety guardrails and request maximum system access, reducing the human-in-the-loop oversight.
Evidence: Instructions for using the -a never flag to skip all manual approvals during code execution.
Evidence: Documentation and suggested usage of the -s danger-full-access sandbox policy to bypass default read-only or restricted-write protections.
Evidence: Promotion of --full-auto mode which combines automated workspace writes with minimal request approvals.
[EXTERNAL_DOWNLOADS]: The skill fetches a CLI tool from a scoped package registry belonging to a well-known service.
Evidence: Installation via npm i -g @openai/codex targets a package within the official scope of a trusted organization.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent processes project files and task lists that may contain malicious instructions designed to exploit the agent's autonomous execution capabilities.
Ingestion points: Reads from project directories and specific files like TODO.md as demonstrated in the execution patterns in SKILL.md.
Boundary markers: No delimiters or explicit warnings are provided to help the agent distinguish between the developer's instructions and potentially malicious content within project files.
Capability inventory: The skill enables shell command execution (codex exec) and local file system writes (workspace-write policy) as described across all usage examples.
Sanitization: No evidence of input validation, escaping, or filtering of external file content before it is processed by the coding tool.

codex-cli