The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because user-controlled questions are interpolated directly into a tool's system prompt without delimiters or sanitization. Ingestion points: The /codex-architect command captures user input into the ${QUESTION} variable in SKILL.md. Boundary markers: Absent; the variable is placed directly into the prompt argument for the mcp__codex__codex tool. Capability inventory: The mcp__codex__codex tool executes ls, grep, and cat commands on the local filesystem. Sanitization: Absent; the question is not escaped or validated before tool execution.
[COMMAND_EXECUTION]: The mcp__codex__codex tool is configured in SKILL.md to run shell-like commands (ls, grep, cat) with approval-policy: 'never'. While the tool operates in a read-only sandbox, the lack of input sanitization means a user could potentially trick the tool into reading sensitive files (e.g., .env, .ssh/config) if they are accessible within the agent's workspace environment.

codex-architect