The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the codex command-line tool via Bash. This tool is not a standard system utility, and the skill provides instructions for passing arbitrary English prompts to it, which can result in the generation and execution of dangerous commands on the host system.
[PRIVILEGE_ESCALATION]: The skill documents and provides examples for using the -s danger-full-access sandbox mode and the -a never approval policy. As explicitly stated in the documentation, these settings remove all security restrictions and allow the tool to execute commands without user confirmation, effectively bypassing standard agent safety controls.
[METADATA_POISONING]: The skill metadata and instructions claim to use "GPT-5.3-codex", "o3", and "o4-mini" models. These models are non-existent in the current public AI ecosystem, suggesting intentional deception or misrepresentation of the tool's backend capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest project context and files to be processed by an external CLI tool, creating a vulnerability where malicious instructions hidden in processed data could influence the agent's behavior.
Ingestion points: The skill reads project files, code snippets, and UI mockups to construct prompts for the CLI tool (SKILL.md, Step 2 and Step 4).
Boundary markers: The skill does not employ programmatic delimiters to separate untrusted file content from the delegation instructions.
Capability inventory: The skill has access to Bash execution, file reading, and file writing tools.
Sanitization: While the instructions advise treating Codex output as untrusted, there is no automated sanitization or filtering of the content being sent to or received from the CLI tool.

codex