The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell-based operations for state management and configuration, including the use of eval to execute output from a local vendor binary (gstack-slug).
[REMOTE_CODE_EXECUTION]: A potential command injection vulnerability exists when sending data to the external codex tool.
Ingestion points: Untrusted data is ingested from the project plan and design document.
Boundary markers: No delimiters or sanitization instructions are used during the interpolation of plan content into shell commands.
Capability inventory: The skill uses bash subprocess calls to execute the codex utility with strings containing the interpolated plan content.
Sanitization: There is no evidence of escaping or validation of the plan content before it is placed into the shell command string, allowing a crafted plan to break out of the command context.
[DATA_EXFILTRATION]: Project documents, architectural plans, and design requirements are transmitted to external AI services (Codex) as part of the core review functionality.
[PROMPT_INJECTION]: The skill includes instructions to bypass standard human verification protocols. When the SPAWNED_SESSION environment variable is detected, the agent is directed to skip AskUserQuestion prompts and auto-choose recommendations, effectively removing necessary human oversight and confirmation gates in automated contexts.

plan-eng-review