The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes project-defined scripts such as npm run lint:fix and language-specific tools like go fmt, go vet, black, and ruff. These commands run in the user's environment, and their behavior depends on the configuration of the repository being reviewed.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8).
Ingestion points: The agent ingests untrusted data from the repository via git diff and direct file reads of CHANGELOG.md and source code (SKILL.md, Steps 1 and 4).
Boundary markers: No specific delimiters or boundary markers are employed to isolate the code being analyzed from the agent's instructions.
Capability inventory: The agent has extensive capabilities including Bash (via the Task tool) and file modification via Write and Edit to 'proactively fix' reported issues.
Sanitization: There is no evidence of sanitization or filtering of the ingested code content.
Risk: An attacker could craft a code change containing malicious instructions (e.g., in a comment or string) that, when processed by the AI during the review and 'fix loop', tricks the agent into performing unintended file modifications or command executions.
[EXTERNAL_DOWNLOADS]: The skill requires the external codex CLI and standard development tools (linters/formatters) which must be present in the user's PATH.

codex-review