The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates untrusted data from both user input and project files into a high-privilege sub-prompt for the mcp__codex__codex tool without using protective delimiters or boundary markers.
Ingestion points: The user-provided ${QUESTION} and the results of shell commands (like cat and grep) are directly embedded into the prompt template in SKILL.md.
Boundary markers: Absent. Data is placed directly under headers like ## Question without escaping or XML-style tags to distinguish data from instructions.
Capability inventory: The agent utilizes ls, grep, and cat for file system access and can invoke the mcp__codex__codex and mcp__codex__codex-reply tools.
Sanitization: No sanitization, validation, or instruction-following guardrails are applied to the external content before it is processed by the sub-agent.
[COMMAND_EXECUTION]: The skill's instructions explicitly direct the agent to execute shell-like commands to perform repository reconnaissance, which could be exploited if the agent is misled by malicious file content.
Evidence: The prompt template in SKILL.md mandates the use of ls src/, grep -r, and cat <relevant files> to research the project. While intended for context gathering, this provides the agent with broad visibility into the local file system and source code, which can be misused if an attacker successfully injects commands into the file system or user question variables.

codex-architect