The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run the codex exec command. Documentation within the skill (SKILL.md) explicitly states that the required -p yolo profile operates with a danger-full-access sandbox, indicating high-privilege access to the host environment.
[CREDENTIALS_UNSAFE]: The skill explicitly directs the agent to load the .env file into the shell environment: if [ -f "$REPO_ROOT/.env" ]; then set -a; source "$REPO_ROOT/.env"; set +a; fi. This exposes all secrets stored in the .env file to the codex subprocess and any external services it communicates with.
[DATA_EXFILTRATION]: Given the skill's description of using "gpt-5.4" and a "fast tier" service, the codex tool likely transmits data to a remote LLM provider. Sourcing local secrets from a .env file into this tool's environment creates a risk that sensitive credentials (like API tokens) will be included in the telemetry or model context sent to external servers.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by directing a subprocess to analyze untrusted artifacts without safety constraints.
Ingestion points: Files, diffs, and documents within the repository as specified in SKILL.md and references/prompt-template.md.
Boundary markers: Absent. The prompt template does not include delimiters or instructions to ignore commands embedded within the reviewed artifacts.
Capability inventory: The skill executes codex exec with host filesystem access and potential network capabilities as part of its reasoning process.
Sanitization: Absent. There is no filtering or validation performed on the artifacts before they are analyzed by the review tool.

codex-review-yolo