The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of a local shell script (scripts/setup) to manage configuration. This script performs file system operations in the user's home directory, including creating directories in ~/.codex/ and modifying the config.toml file to register new agent roles.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from the project repository, such as git diffs and source code files. Malicious content within the files being reviewed could attempt to influence the agent's logic or implementation decisions.
Ingestion points: The agent is instructed to read committed changes, staged/unstaged diffs, and untracked code files from the local repository for review.
Boundary markers: The instructions for the sub-agents and the main polishing loop do not employ explicit delimiters or system-level warnings to distinguish between the analyzed code and the agent's core instructions.
Capability inventory: While the sub-agents are configured for read-only sandbox mode, the main owner agent has the capability to apply file edits (fixes) to the codebase based on the findings generated from the untrusted data.
Sanitization: No sanitization, validation, or filtering of the ingested source code is performed before it is passed to the reviewer agents.

polisher