The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/codex_image.py executes the external codex binary using the subprocess.Popen function. The implementation correctly passes the command as a list rather than a shell string, which follows security best practices for preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of text prompts and reference images, which are then passed to the image generation model. This creates a standard surface for indirect prompt injection where instructions could be hidden in the data to influence the model's output or tool usage.
Ingestion points: The script accepts untrusted user input via the --prompt, --prompt-file, --edit, and --reference arguments in scripts/codex_image.py.
Boundary markers: The script wraps the user-provided request in internal templates like PREAMBLE and EDIT_PREAMBLE. While these guide the model's behavior, they do not serve as formal security boundaries or sanitization layers.
Capability inventory: The skill has the capability to execute the codex CLI and write files (generated images) to the local filesystem.
Sanitization: No sanitization, filtering, or escaping is performed on the input prompt text before it is passed to the execution tool.

codex-image-gen