The Agent Skills Directory

[EXTERNAL_DEPENDENCIES]: The skill instructs the installation of a global Node.js package @bitkyc08/opencodex from the npm registry. This package does not originate from a trusted organization or the skill author's known infrastructure.- [COMMAND_EXECUTION]: The skill uses multiple shell commands to interact with the local environment, including npm install, ocx health, ocx logs, and PowerShell's Get-Content to monitor service status and logs.- [DATA_EXPOSURE]: The skill targets sensitive local files including ~/.opencodex/config.json and ~/.opencodex/service-api-token. These files are documented to store API keys, authentication tokens, and provider configuration, creating a risk of credential exposure if accessed by a compromised agent.- [PERSISTENCE_MECHANISMS]: The skill documentation includes instructions for managing background services and auto-start mechanisms ("自动启动") to ensure the OpenCodex proxy remains active across sessions.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading service logs (~/.opencodex/service.log) and request logs (~/.opencodex/usage.jsonl).
Ingestion points: ~/.opencodex/usage.jsonl and service.log containing model response metadata and error details.
Boundary markers: None provided in instructions for processing these logs.
Capability inventory: Global package installation (npm), service control (ocx restart), and system file reading (Get-Content).
Sanitization: No sanitization or validation of log content is mentioned before the agent interprets the "explain" results.

opencodex-setup