The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent is designed to read and process the entire codebase, which creates a significant surface for indirect prompt injection. A malicious file within the project could contain instructions that the agent might follow during its analysis or implementation tasks.
Ingestion points: The agent accesses codebase content via codex_read_file, read_file, and codex_codebase_search as defined in agents/openai.yaml.
Boundary markers: No explicit instructions or delimiters are defined in the system prompt to distinguish between agent instructions and the source data being processed.
Capability inventory: The agent has access to sensitive tools including bash for shell command execution and various file-writing tools such as codex_write_file and search_replace.
Sanitization: No input sanitization or validation mechanisms are described for the data read from the codebase.
[COMMAND_EXECUTION]: The skill configuration in agents/openai.yaml provides the agent with access to the bash tool. While the documentation in SKILL.md describes using this for standard tasks like running tests (cargo test, npm test) and build commands, the tool itself provides a broad surface for arbitrary shell command execution.

executor