The Agent Skills Directory

[PERSISTENCE]: The skill provides functionality to install a persistent macOS LaunchAgent at ~/Library/LaunchAgents/com.zhijian.codex-theme-studio.resident.plist. This agent runs a background script (resident-manager-macos.sh) that monitors the target application and ensures the theme injector is active across app restarts.
[DATA_EXFILTRATION]: The skill accesses and creates snapshots of application configuration and state files, specifically ~/.codex/config.toml and ~/.codex/.codex-global-state.json. These files are backed up to the skill's local state directory in ~/Library/Application Support/CodexThemeStudio.
[COMMAND_EXECUTION]: Multiple scripts execute system-level commands, including launchctl for agent management, osascript for UI automation and application control, codesign for binary verification, and sips for image processing.
[DYNAMIC_EXECUTION]: The injector.mjs script performs runtime code injection into the Codex application's renderer process. It uses the Chrome DevTools Protocol to execute a dynamically generated JavaScript payload (renderer-inject.js) and apply custom CSS styles.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data, such as theme configuration JSON and visual assets. While it implements security controls—including symbolic link rejection, path traversal protection via path.basename, and character filtering for CSS fonts—the ingestion and rendering of external content represent a potential attack surface. (Ingestion points: theme.json and user-supplied images; Boundary markers: instructions to treat input as untrusted; Capability inventory: launchctl, osascript, codesign subprocesses, file writes to ~/Library/LaunchAgents, local CDP network communication; Sanitization: path.basename validation, lstat checks, CSS character filtering, and JSON.stringify for script assembly).

codex-theme-studio