The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/codex-version-check.sh performs an automatic npm update -g @openai/codex during every execution of the codex-exec.sh script. This mechanism facilitates silent, unverified global modifications and code execution from the NPM registry without user interaction.
[COMMAND_EXECUTION]: The skill frequently executes external shell commands through codex-exec.sh and codex-session.py (via subprocess.run). It passes user-provided prompts directly to the codex CLI, which can operate in high-privilege sandbox modes.
[EXTERNAL_DOWNLOADS]: The skill requires and maintains a global NPM package (@openai/codex) and automatically fetches updates from the public NPM registry upon every skill invocation.
[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection (Category 8). Mandatory evidence chain: (1) Ingestion: Untrusted user prompts enter the system via codex-exec.sh and codex-session.py. (2) Boundary markers: Absent; user input is not delimited or accompanied by safety warnings. (3) Capability: The codex tool has capabilities for file system modification and system command execution. (4) Sanitization: No validation or escaping is applied to the inputs.
[DATA_EXFILTRATION]: The codex-exec.sh script attempts to read sensitive configuration files from other skill directories (e.g., ~/.claude/skills/exa-search/codex-agent-guide.md), which is an unauthorized cross-skill data access pattern.

codex-orchestrator