The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The skill provides access to the --yolo flag. As documented in SKILL.md and references/exec-reference.md, this mode offers 'No restrictions', 'No sandbox', and 'Full system access'. In non-interactive mode, this allows an LLM to execute arbitrary commands and modify files on the host system without any human-in-the-loop verification.
CREDENTIALS_UNSAFE (MEDIUM): The documentation in SKILL.md and references/exec-reference.md encourages the use of CODEX_API_KEY=sk-... to authenticate. While this is a standard CLI pattern, in the context of an AI agent, it increases the risk of the key being logged, exposed in process trees, or leaked if the environment is captured.
DATA_EXPOSURE (LOW): The tool is designed to read from any file path provided in a prompt (e.g., ~/.codex/config.toml, ~/.aws/credentials). When combined with the --yolo or --full-auto flags, it has the capability to read and potentially exfiltrate sensitive configuration files.
INDIRECT_PROMPT_INJECTION (LOW): The skill is intended to process external codebases and PR diffs. It lacks explicit boundary markers or sanitization instructions for the data it ingests, making it a surface for indirect prompt injection where malicious comments in a codebase could influence the agent's execution of codex exec commands.

codex