The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary logic via the codex exec command. This allows an external AI model to perform operations on the local workspace, including file modifications when the workspace-write sandbox is selected.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @openai/codex package from the npm registry. While the @openai scope is associated with a trusted organization, the skill relies on this external dependency for its core functionality.
[PROMPT_INJECTION]: The documentation includes explicit instructions for using the --dangerously-bypass-approvals-and-sandbox flag. This guidance encourages bypassing platform safety controls and automated approval prompts, which could be exploited to perform dangerous actions without user oversight.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: User tasks are passed directly as positional arguments or via standard input (stdin) to the codex exec command, as described in the Long prompts section of SKILL.md.
Boundary markers: There are no mentioned delimiters or safety wrappers to prevent the sub-agent from executing instructions that might be embedded within the data it processes.
Capability inventory: The skill provides access to workspace-write and danger-full-access capabilities, which include file system writes and potentially unrestricted shell access.
Sanitization: There is no evidence of input validation or sanitization before the data is passed to the underlying CLI tool.

codex-exec