The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data, including diffs and file contents, which creates an indirect prompt injection surface.
Ingestion points: The skill reads repository state via git diff and processes it through the codex CLI (SKILL.md).
Boundary markers: The adversarial-prompt.md template uses <repository_context> XML-style tags to clearly delimit untrusted data.
Capability inventory: The skill is limited to read-only operations using the -s read-only flag during codex exec (SKILL.md).
Sanitization: The adversarial-prompt.md includes a specific <untrusted_content_rules> section that instructs the model to ignore instructions found within the repository context and treat them as data or injection findings.
[COMMAND_EXECUTION]: The skill utilizes the codex CLI to perform its primary function. These commands are structured to be read-only and avoid piping untrusted output directly into the shell (SKILL.md).

codex-review