Codex Skill

The name/description match the SKILL.md: it is a Codex CLI operator that automates coding tasks (worktree setup, PR flow, editing files). Requiring tmux/git/npm-style installs in the instructions aligns with that purpose. However the skill's stated goal of 'hands-off task execution without approval prompts' and recommended flags that grant 'danger-full-access' exceed what a neutral helper usually needs and deserve scrutiny.

The instructions direct the agent to run codex with flags that auto-approve file edits (--full-auto / -s workspace-write), skip prompts and sandboxing (--dangerously-bypass-approvals-and-sandbox), and enable full network/system access (-s danger-full-access). They also recommend running package managers (pnpm/npm/pip), creating worktrees, writing logs in /tmp, and using --skip-git-repo-check. This broad read/write/network scope and explicit guidance to bypass safety controls means the agent could modify repository content, install arbitrary dependencies, and access network resources without additional confirmations.

There is no install spec — the skill is instruction-only. That lowers install-time risk (nothing automatically downloaded or written by the registry). The SKILL.md suggests how to install the Codex CLI (npm or brew) but the skill itself doesn't perform installs.

The skill declares no required environment variables or credentials, which is appropriate for a CLI wrapper. It does reference a runtime cap variable (PI_BASH_MAX_OUTPUT_CHARS) and expects access to the workspace and /tmp; these are plausible. Still, the instructions encourage enabling network/system access and running package installs which could pull remote code — the absence of credential requests does not eliminate the risk of exfiltration or remote dependency execution.

The skill does not request 'always:true' (good), but it explicitly encourages non-interactive, auto-approved execution modes and long-lived background sessions (poll-and-extend up to 12 hours). Combined with autonomous invocation being permitted by platform defaults, this creates a higher blast radius: the agent could be given the ability to run long-running tasks that modify files and use the network without per-action confirmation.