The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses codex exec to run shell commands in a background process (specifically a bash loop) to collect git diffs and perform analysis. This pattern involves executing shell commands with a 600-second timeout to handle repository operations.
[PROMPT_INJECTION]: The skill includes advanced defensive patterns against indirect prompt injection in the adversarial-prompt.md template. It explicitly defines <untrusted_content_rules> that instruct the model to treat all repository data (diffs, comments, messages) as data rather than instructions, and to flag any behavior-altering text as an injection finding itself.
[COMMAND_EXECUTION]: In Phase 1, the Opus lane is granted shell access to collect repository data. The skill documentation explicitly notes that 'read-only-ness' is enforced by prompt compliance rather than tool-level sandboxing, creating a reliance on the model's adherence to instructions.
[PROMPT_INJECTION]: The skill ingests external, untrusted repository content (git diff, file reads) and interpolates it directly into prompts via placeholders like {{REVIEW_INPUT}}. While vulnerable to indirect prompt injection, the risk is mitigated by the inclusion of clear boundary markers (<repository_context>) and the aforementioned adversarial grounding rules.
[DATA_EXPOSURE]: The skill requires an absolute repository path (repo) and accesses local files to generate a diff and perform code reviews. While this exposes source code to the configured models (e.g., GPT-5.6-terra, Claude Opus), the purpose of the skill is inherently centered on these files, and it does not demonstrate patterns of exfiltrating data to external domains.

multi-model-review