The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as pull requests and git repositories, which presents an attack surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through commands like gh pr checkout and git fetch mentioned in SKILL.md.
Boundary markers: The instructions lack explicit boundary markers or directives to the agent to disregard instructions embedded within the processed code or PR metadata.
Capability inventory: The skill utilizes the terminal tool to execute shell commands and the process tool for lifecycle management, providing a path for arbitrary execution.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from external repositories before it is processed by the coding agent.
[COMMAND_EXECUTION]: The instructions promote the use of the --yolo flag for the Codex CLI. This flag explicitly disables sandboxing and user approval for file modifications, which significantly increases the risk if the agent is manipulated by malicious input.
[CREDENTIALS_UNSAFE]: The skill documentation identifies specific filesystem paths where authentication credentials and session tokens are stored, specifically ~/.hermes/auth.json and ~/.codex/auth.json. This exposure provides a direct target for data harvesting if the environment is compromised.

codex