The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a secondary agent through the mcp__codex__codex tool with the approval-policy parameter set to never. This enables the sub-agent to execute shell commands such as grep and read automatically without manual approval, although the risk is mitigated by a sandbox: 'read-only' constraint.
[PROMPT_INJECTION]: User-provided strings (e.g., userQuestion, featureName, problemDescription) are interpolated directly into the task prompts for the secondary agent. This creates a surface for indirect prompt injection where malicious user input could attempt to bypass the skill's logic or influence the agent's output.
Ingestion points: Variables ${userQuestion}, ${featureName}, and ${problemDescription} in the references/prompts.md file.
Boundary markers: The prompt templates utilize Markdown headers to separate project info from task requirements but lack explicit instruction delimiters or 'ignore' warnings for the variable content.
Capability inventory: The secondary agent has access to Bash, Grep, Glob, and Read tools for codebase analysis.
Sanitization: There is no evidence of sanitization, filtering, or escaping for the user-supplied strings before they are embedded into the prompt.

code-investigate