Secure Skill Installation in Codex

Installing third-party Codex Skills is convenient.

But there’s also a risk:

A Skill is essentially a bundle of prompts, workflows, and tool-calling rules.

Once installed, external content can enter the Agent’s execution flow and context.

More importantly, some Skills may:

  • call MCP servers
  • request shell access
  • alter workflows
  • override system instructions

In practice:

id
1
2
3
Installing a Skill
≈
Injecting new behavioral rules into your Agent

To reduce that risk, I added a lightweight security gate for Codex Skill installation using SlowMist Agent Security.

Core Idea

The idea is simple:

Whenever a Skill is installed:

id
1
2
review first
-> install second

A Skill is only allowed into:

id
1
~/.codex/skills

after passing a security review with SlowMist Agent Security.

The entire process is triggered through AGENTS.md using on-demand policy loading, instead of permanently stuffing large security rules into the Agent context.

1. Install SlowMist Agent Security

Place slowmist-agent-security inside the Codex skills directory:

id
1
~/.codex/skills/slowmist-agent-security/

Directory structure:

id
1
2
3
4
SKILL.md
reviews/
patterns/
templates/

2. Add a Skill Installation Check Rule

Create:

id
1
~/.codex/skill-install-check.md

Content:

id
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Skill Installation Security Gate

Apply these rules only when the task involves installing a skill from any external or local source.

Before installation, run `[$slowmist-agent-security](@skills/slowmist-agent-security/SKILL.md)`.

Use the Skill/MCP review flow in `@skills/slowmist-agent-security/reviews/skill-mcp.md`.

Do not install the skill unless the security review finds no meaningful risk.

Enforcement rules:
- `LOW`: installation may proceed.
- `MEDIUM`: pause and get explicit user confirmation before proceeding.
- `HIGH` or `REJECT`: do not install.
- If the review cannot be completed, treat the skill as untrusted and do not install it.

Using relative references like:

id
1
@skills/...

instead of absolute user paths makes the setup easier to migrate between environments.

3. Configure AGENTS.md for On-Demand Loading

Then update:

id
1
~/.codex/AGENTS.md

with a single line:

id
1
When installing any skill, first read and follow `@skill-install-check.md`.

Why Not Put All Security Rules Directly in AGENTS.md?

Because large rule sets pollute the context window.

If full security policies are always present in the Agent context:

  • everyday tasks become noisier
  • token usage increases
  • later rules become easier to ignore
  • the Agent is more likely to overlook instructions

So this setup uses:

id
1
on-demand policy loading

The security rules are only loaded when the task involves:

id
1
Skill installation

At that point, Codex reads:

id
1
@skill-install-check.md

This keeps the workflow lighter and more reliable.

Final Workflow

After configuration, the Skill installation flow becomes:

id
1
2
3
4
5
6
7
installation request
-> read @skill-install-check.md
-> trigger SlowMist Agent Security
-> run Skill/MCP review flow
-> LOW: continue installation
-> MEDIUM: request user confirmation
-> HIGH / REJECT: block installation

Conceptually, this is a:

  • conditional policy loading system
  • soft security gate
  • human-in-the-loop review workflow

It doesn’t require modifying Codex itself or building a complex sandbox.

But it can still significantly reduce the risk of:

  • prompt injection
  • malicious MCP integrations
  • supply-chain contamination
  • high-risk third-party Skills

Additional Notes

At the moment, this is still a:

id
1
Soft Gate

because it relies on Codex following AGENTS.md.

For stronger enforcement, the security review can be integrated directly into the Skill installation script itself:

id
1
2
3
4
download
-> review
-> allow / block
-> copy to ~/.codex/skills

That way, even if the Agent is affected by prompt injection, the installer itself can still prevent high-risk Skills from entering the system.