The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts to extract repository information (git diffs, branch bases). These scripts interpolate variables such as $USER_BASE and $DIR directly into command lines, creating a potential shell injection surface if these variables are influenced by untrusted project metadata.
Evidence: Shell logic in the 'Review Targeting' section of SKILL.md.
[COMMAND_EXECUTION]: The instructions encourage the use of the --dangerously-bypass-approvals-and-sandbox flag for specific tasks, which disables essential security boundaries and user approval workflows.
Evidence: Usage recommendations in the 'Sandbox mode' and 'Delegate a Task' sections of SKILL.md.
[EXTERNAL_DOWNLOADS]: Fetches and installs the Codex CLI tool from OpenAI's official NPM registry.
Evidence: Installation command 'npm install -g @openai/codex' provided in the 'Error Handling' section of SKILL.md.
[DATA_EXFILTRATION]: The skill transmits project-specific code diffs and file contents to external AI models for analysis, which is inherent to its functionality but represents a sensitive data transfer.
Evidence: Invocations of codex exec that process diffs and project files throughout the skill.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted diffs and logs from the current repository and feeds them to a model with the ability to modify the workspace.
Mandatory Evidence Chain:
Ingestion points: SKILL.md processes output from git diff and git log.
Boundary markers: Uses structured headers and an 'Adversarial Prompt Template' to encapsulate user and repository data.
Capability inventory: The codex exec tool has file system write access (--full-auto) and arbitrary command execution capabilities.
Sanitization: There is no documented logic for escaping or sanitizing the content of the diffs or logs before they are passed to the external model.

codex-cli