The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes user-supplied proposals and 'extra focus' text which are subsequently read by an external LLM. This creates an attack surface for indirect prompt injection.
Ingestion points: User input captured via argument-hint and instructions to record the proposal verbatim are written to /tmp/critique-proposal.md as described in SKILL.md.
Boundary markers: The skill uses a ## Extra focus from the user header to separate content but lacks explicit system instructions for the Codex model to ignore or escape instructions contained within that section.
Capability inventory: The skill uses the Write tool to create temporary files and Bash to execute the codex script.
Sanitization: The skill follows best practices by using file-based communication for the model to avoid shell-level command injection, but does not perform sanitization of the natural language content for LLM-level injection.
[COMMAND_EXECUTION]: The skill executes a local script ${CLAUDE_PLUGIN_ROOT}/scripts/codex and uses jq to parse JSONL data. These are standard operations for an agent skill and do not involve untrusted remote code execution.

critique