The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to execute its scripts with dangerouslyDisableSandbox: true. This bypasses the built-in security protections of the environment, allowing the scripts and the external Codex tool full access to the host system APIs (specifically macOS SCDynamicStore).
[COMMAND_EXECUTION]: The core functionality relies on the codex exec command. This executes logic via an external CLI tool that interacts with system APIs and remote services, creating an opaque execution path outside the agent's direct control.
[EXTERNAL_DOWNLOADS]: The documentation requires the global installation of an NPM package @openai/codex. Users must verify the authenticity of this package as it deviates from the standard OpenAI library naming conventions.
[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that ingests untrusted data—including project source code, implementation plans, and user task descriptions—and interpolates them directly into prompts for a secondary reviewer agent.
Ingestion points: scripts/codex-review.sh reads plan files (--plan-file) and implementations (--description-file) to be reviewed.
Boundary markers: The build_review_prompt function uses simple text headers like "Description from Claude:" and "Focus areas:" which are insufficient to prevent adversarial content from overriding instructions.
Capability inventory: The system uses codex exec (process spawning and network access) and performs extensive file system operations (read/write/archive) in the .codex-review/ directory.
Sanitization: No sanitization or escaping is performed on the code or plan content before it is placed into the prompt template; only basic character filtering is applied to the metadata label in common.sh.

codex-review