The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates the $ARGUMENTS variable directly into shell commands within references/command.md, including git diff, git show, and git log. If the user input is not properly sanitized by the agent, this could allow for command injection by appending shell metacharacters.
[DATA_EXFILTRATION]: The skill is instructed in SKILL.md to use a specific configuration file located at ~/.codex/consensus.json. Accessing hidden configuration files within the user's home directory is a sensitive operation as these files often contain API keys, session tokens, or other credentials required for multi-model interactions.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted code and diff data from external repositories.
Ingestion points: Source code, git diffs, and commit messages are read using git commands defined in references/command.md.
Boundary markers: The instructions attempt to use markdown horizontal rules (---) to delimit the review target, which provides minimal protection against adversarial content.
Capability inventory: The skill has the capability to execute shell commands (git) and read files throughout the repository.
Sanitization: There is no evidence of sanitization or filtering applied to the code content before it is processed by the lead reviewer or external models.

consensus-code-review