The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to interact with the external 'codex' CLI tool, utilizing complex command strings that include piping, redirections, and specific environment flags.
Evidence: Execution of codex exec and codex exec resume via the bash tool in the SKILL.md file.
Evidence: Implementation of shell redirections such as < /dev/null and 2>/dev/null to force non-interactive behavior in the CLI.
[DYNAMIC_EXECUTION]: The skill constructs shell commands at runtime using data parsed from the output of previous command executions.
Evidence: The logic parses a thread_id from the JSON response of an initial codex exec call and subsequently interpolates that variable into the codex exec resume "$THREAD_ID" command.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by instructing an external model to read and process the contents of the local repository and the PLAN.md file, which may contain untrusted or malicious instructions.
Ingestion points: The skill reads PLAN.md and other unspecified repository files as context for the Codex review model.
Boundary markers: The skill uses a static instruction block to frame the review prompt but does not employ robust delimiters or "ignore previous instructions" safety markers for the repository content itself.
Capability inventory: The skill has access to shell command execution (bash), file writing (PLAN.md, PLAN-REVIEW-LOG.md), and network communication through the codex CLI tool.
Sanitization: There is no evidence of sanitization, filtering, or validation of the repository data before it is sent to the external model for processing.

codex-review