The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the execution of an external command-line tool room-cli to perform its core functions. It executes several subcommands including provider models, thread show, thread wait, and thread output to manage the review process.
[DATA_EXFILTRATION]: To perform the review, the skill is instructed to "reuse the current environment, including uncommitted work." This involves reading local source code and project context and sending it to an external provider (identified as codex) via the room-cli tool. While this is necessary for the skill's stated purpose of code review, it constitutes the egress of potentially sensitive local data to a third-party service not listed among well-known or trusted providers.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded within the code it reviews, which could influence the agent's behavior or the review's outcome.
Ingestion points: The skill ingests the entire "current environment" and "uncommitted work" (local files and staged changes) via the room-cli tool.
Boundary markers: The instructions do not specify any delimiters or special markers to isolate the untrusted code from the agent's core instructions, nor do they include warnings to ignore instructions found within the code.
Capability inventory: The skill possesses the ability to execute shell commands (room-cli) and transmit data externally, which could be exploited if an attacker-controlled code file contains malicious instructions that are followed by the model.
Sanitization: There is no evidence of sanitization, filtering, or validation of the local files before they are processed by the reviewer model.

gpt-review