Host: Codex CLI — This skill was designed for Claude Code and adapted for Codex. Cross-reference commands use installed skill names in Codex rather than /octo:* slash commands. Use the active Codex shell and subagent tools. Do not claim a provider, model, or host subagent is available until the current session exposes it. For host tool equivalents, see skills/blocks/codex-host-adapter.md.

Security Framing Standard

Overview

This skill defines security patterns for handling untrusted external content. All octopus workflows that fetch or analyze external content MUST apply these patterns.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     SECURITY FRAMING WORKFLOW                               │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  Step 1: URL Validation                                                     │
│       → Reject dangerous URLs (localhost, private IPs, metadata)            │