The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to bypass user confirmation and safety prompts for high-risk operations. It states that "Sandbox flags need no permission prompt on this machine" and instructs the agent to use flags like --full-auto and --sandbox danger-full-access without using AskUserQuestion, which undermines the platform's consent and safety model.
[COMMAND_EXECUTION]: The skill relies extensively on shell execution via the Bash tool to interact with the Codex CLI. It performs background task execution, processes exit codes, and uses /tmp/ files to pipe complex inputs to shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it is designed to ingest and summarize untrusted data from external code repositories and CLI outputs.
Ingestion points: The agent reads and processes repository code and the textual output of the codex exec and codex review commands.
Boundary markers: There are no specific delimiters or warnings provided in the instructions to the agent to treat external content as untrusted data.
Capability inventory: The skill utilizes Bash execution for background tasks and has the ability to write to the local filesystem (/tmp/).
Sanitization: No evidence of sanitization or escaping of external content is present in the skill's instructions.
[EXTERNAL_DOWNLOADS]: The README file provides installation instructions that involve cloning code from a remote Git repository (git@github.com:skills-directory/skill-codex.git) and executing shell commands to move the content into the agent's skill directory.

codex