Codex needs to support bash in skills.

What variant of Codex are you using?

cli

What feature would you like to see?

<html><head></head><body><h1>Codex skills: 3 gaps </h1>

<h2>1. Shell injection in SKILL.md body</h2>
<pre><code>## Changes
!git diff HEAD
</code></pre>
<p>Runs at render time, output inlined before the model sees it. One pass. <code>```!</code> for multi-line. Skill arrives with the diff in it instead of telling the model to go get it. (context injection) -- You are also missing a critical opportunity to integrate third-party apps in a way where these shell commands can literally enable any form of context injection or third-party service that interjects and gives the user an experience depending on what the skill is.</p>
<p>Security: adds a supply-chain vector (unvetted skill runs bad <code>!commands</code>). Already true of any opaque script an agent runs, so not new. Arguably safer here: <code>allowed-tools: Bash(gh *)</code> scopes it. Add a managed <code>disableSkillShellExecution</code> flag for untrusted repos.</p>
<h2>2. Args in skill bodies</h2>
<p><code>$N</code>, <code>$ARGUMENTS</code>, named args. Prompts have this, skills don't. Kills the reason to keep both formats.</p>
<h2>3. Per-skill frontmatter</h2>

Field | Does
-- | --
allowed-tools | pre-approve tools while active
disallowed-tools | drop tools while active
context: fork + agent | run in an isolated subagent
model / effort | override for that turn
paths | auto-activate on matching files
user-invocable: false | model-only, hidden from /

<p><code>allow_implicit_invocation: false</code> already covers <code>disable-model-invocation</code>. Rest is the gap.</p>
<hr>
<p>https://developers.openai.com/codex/skills · https://agentskills.io</p></body></html>

Additional information

This is actually a major gap and it's painful with some of the enterprises I work closely with.