The Agent Skills Directory

[COMMAND_EXECUTION]: Potential Shell Command Injection. User-supplied input (e.g., instructions, focus areas, or questions) is directly interpolated into double-quoted strings within bash commands (e.g., codex review "<instructions>" or codex exec "<prompt>"). This allows a malicious user or an adversarial data source to execute arbitrary shell commands via metacharacters like backticks, $(), or semicolons.
[COMMAND_EXECUTION]: Execution of local scripts and eval usage. The skill frequently invokes binaries from ~/.claude/skills/gstack/bin/ and uses eval to process their output (e.g., eval "$(~/.claude/skills/gstack/bin/gstack-slug ...)"). This pattern relies entirely on the integrity of the local file system and the scripts provided by the vendor.
[PROMPT_INJECTION]: Inconsistent behavior instructions. The skill contains a 'Filesystem Boundary' and 'Important Rules' section explicitly stating 'Never modify files. This skill is read-only.' However, other sections of the skill provide explicit instructions to use git commit to modify CLAUDE.md and use Edit or Write tools to modify project plan files. Such contradictions can lead to unexpected state changes in the repository.
[REMOTE_CODE_EXECUTION]: Dynamic script execution. The skill embeds a Python script to parse JSONL output from the Codex CLI. While the script itself appears limited to parsing, the pipeline involves piping potentially untrusted output from an external AI model directly into an interpreter.
[EXTERNAL_DOWNLOADS]: Instruction to install external software. The skill prompts the user to install the @openai/codex package globally via npm, which introduces an external dependency not managed by the skill's own environment.

codex