The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform repository-level operations like git diff and to invoke the codex CLI tool. It includes complex logic for environment detection (which codex) and performs a 'smoke test' by executing a temporary command to ensure the toolchain is functional.
[EXTERNAL_DOWNLOADS]: The skill relies on external communication with third-party LLM providers (specifically OpenAI and OpenRouter) via the codex CLI or codex-mcp tools to conduct its reviews. These communications involve sending user workspace data to external endpoints for processing.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant exposure to indirect prompt injection as it ingests untrusted data from the local workspace (code, diffs, and plans) and external LLM responses. Malicious instructions embedded in the reviewed code could potentially influence the agent's behavior. The skill attempts to mitigate this by using boundary markers, structured output schemas, and a mandatory 'finding verification' phase (S5) where every claim must be backed by local evidence.
Ingestion points: Reads git diff output, local file contents (via --code or --plan flags), and responses from external LLM services.
Boundary markers: Employs structural headers like ## 审查请求 and ## 外部审查结论（原始）, and enforces a mandatory termination string === END OF REVIEW === to ensure complete output capture.
Capability inventory: Uses Bash for command execution and file manipulation, Read for data ingestion, AskUserQuestion for user-in-the-loop confirmation, and mcp__codex-mcp for task delegation.
Sanitization: Uses shell heredocs (cat <<'EOF') to safely pass data to CLI tools and requires a manual verification step where the agent must independently confirm findings before presenting them to the user.
[DYNAMIC_EXECUTION]: The skill dynamically generates shell commands and interaction prompts at runtime based on user parameters and workspace state. It also parses and processes external JSON payloads and text output to populate its internal history and reports.

adversarial-review