The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads external session transcript files which can contain arbitrary user and assistant messages from previous sessions. These messages are then used to set the context and determine the agent's next actions, potentially executing instructions embedded in historical logs.
Ingestion points: The scripts/codex-transcript.py script reads JSONL files from the ~/.codex/sessions/ directory and outputs their content to the agent context.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to treat the transcript content as untrusted or separate from current instructions.
Capability inventory: The skill instructions encourage the agent to "Continue" the work, which involves using file editing tools, git commands, and any other available capabilities to fulfill the last request found in the transcript.
Sanitization: While the Python script filters out some specific injected headers (e.g., # AGENTS.md instructions), it does not sanitize the actual content of messages or tool calls which may contain malicious instructions intended to hijack the agent's behavior.
[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/codex-transcript.py) using the command line to process and display session data from the user's home directory.

codex-handoff