codex-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is Codex headless/CI review where the LLM prompt includes $(cat diff.txt) (a runtime-generated git diff from the PR/branch), which can contain outsider-authored free text/code changes from other contributors, and that diff is ingested into the model context via the codex exec ... "Review ...: $(cat diff.txt)" command substitution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime installation and use of remote code (the @openai/codex CLI via "npm install -g @openai/codex" and the GitHub Action "openai/codex-action@main"), which fetch and execute third-party code at runtime and are required for the skill to function.