The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands using the codex CLI tool.
The command codex exec ... "$(cat REVIEW_PROMPT)" uses shell command substitution to read a prompt from a file. This pattern can be risky if the file content is influenced by untrusted input.
The skill uses variable interpolation in shell commands, such as codex exec resume "$THREAD_ID", where the variable is parsed from the JSON output of a previous command.
It uses timeout or gtimeout to manage execution limits, which is a common pattern for handling external tool execution.
[DATA_EXFILTRATION]: The skill facilitates the transfer of local data to an external service.
The adversarial review process involves sending the contents of PLAN.md and potentially other files from the repository to the Codex API via the codex exec command.
The instructions explicitly direct the agent to read ~/.codex/config.toml to extract model information, which is a sensitive configuration file path.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
Ingestion points: The codex tool is instructed to read the plan at PLAN.md and "any repo files you need".
Boundary markers: The skill lacks explicit sanitization or boundary markers for the repository content being reviewed by the external model.
Capability inventory: The agent has the capability to write files (PLAN.md, PLAN-REVIEW-LOG.md), execute shell commands (codex), and read local configuration files.
Sanitization: There is no mention of sanitizing the repository files before they are read by the Codex tool, allowing a malicious file in the repository to potentially influence the review outcome or the agent's behavior.
[DYNAMIC_EXECUTION]: The skill involves the dynamic construction of shell scripts that are then executed via the agent's bash tool, particularly during the loop between Act 1 and Act 2.

grill-me-codex