The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users to save plaintext OPENAI_API_KEY values directly into shell configuration files such as ~/.zshrc and ~/.bashrc. This practice exposes sensitive credentials to any local process and risks unauthorized access to the user's account.- [COMMAND_EXECUTION]: The documentation encourages the global installation of a Node.js package (@openai/codex) and a Homebrew cask (codex) that do not exist as official OpenAI tools. This impersonation of a trusted vendor poses a high risk of supply chain attacks if users are led to install malicious packages with similar names.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by design. It demonstrates processing untrusted input—such as git diffs and pull request content—directly into a prompt without using boundary markers, escaping, or instructions to ignore embedded commands. An attacker could embed malicious instructions in a code change to manipulate the review output.
Ingestion points: diff.txt, staged changes, and pull request comments.
Boundary markers: Absent from the documented command examples.
Capability inventory: Shell execution via codex exec with the --full-auto flag enabled.
Sanitization: No filtering or validation of input data is specified.- [EXTERNAL_DOWNLOADS]: The CI/CD examples reference a non-existent GitHub Action (openai/codex-action@main). This deceptive metadata can mislead developers into integrating untrusted or non-existent components into their build pipelines.- [COMMAND_EXECUTION]: The skill prompts users to append commands and environment variables to shell profiles (~/.bashrc, ~/.zshrc). This behavior is a common persistence mechanism that allows scripts to run or configurations to persist across shell sessions without further user interaction.

codex-review