The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing external data and local project context.
Ingestion points: Reads data from requirement specifications via the --spec argument and local project files like CLAUDE.md.
Boundary markers: Uses Markdown headers in prompt templates as weak delimiters.
Capability inventory: Access to mcp__codex__codex (with workspace write permissions), Edit, Write, and Bash(git:*).
Sanitization: No evidence of input validation or prompt escaping for ingested content.
[COMMAND_EXECUTION]: The skill explicitly directs the AI to execute arbitrary scripts found in the project environment.
Evidence: Instructions in references/codex-prompts.md Phase 4 tell the agent to find and run test commands from package.json or similar configuration files.
Risk: This can lead to the execution of malicious code if the agent is directed to work on a compromised or untrusted codebase.

codex-implement