The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as codex review "$review_prompt" and codex review --commit <sha>. The variable $review_prompt is constructed using multi-line text derived from user-provided 'problem statements' and 'acceptance criteria'. This pattern of shell interpolation is vulnerable to command injection if the user provides input containing shell metacharacters (e.g., backticks, $(), or semicolons) that the shell may evaluate during command execution.
[EXTERNAL_DOWNLOADS]: The skill relies on a non-standard, external command-line tool named codex. The provenance, safety, and installation source of this tool are not defined within the skill, making it an unverifiable dependency required for the skill's primary functionality.
[DATA_EXFILTRATION]: By design, the skill extracts repository information using git status and git diff and passes this content to the external codex tool. This constitutes a transfer of potentially sensitive source code and implementation details to an external process or service.
[PROMPT_INJECTION]: The skill features a large attack surface for indirect prompt injection. It ingests untrusted data from the user to build a 'review contract' which is then passed to an external LLM-based tool ('Codex').
Ingestion points: User-provided problem statements, intended behaviors, and acceptance criteria in SKILL.md.
Boundary markers: The skill does not define clear delimiters or use structured formats like JSON to isolate user-supplied content from the instructions sent to the external reviewer.
Capability inventory: The agent has the capability to execute shell commands (codex), read local files via git tools, and potentially modify the worktree if instructed to 'fix verified findings'.
Sanitization: There is no evidence of sanitization or escaping of external content before it is interpolated into the prompt or the shell command.

request-codex-review