The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several shell commands to manage its workflow, such as git init and git commit for versioning rounds, and find and node to locate and execute the Codex companion script. It also uses perl or gtimeout to implement a watchdog timer for task execution. These are legitimate uses intended to support the skill's documented functionality.
[EXTERNAL_DOWNLOADS]: The skill performs git clone --depth 1 on user-provided repository URLs to create a local source of truth for the LLM reviewers. This grounding mechanism is a security best practice to avoid hallucinations and unnecessary network calls by the models during review. Clones are stored in a git-ignored tmp/ directory.
[PROMPT_INJECTION]: As the skill is designed to process arbitrary user-provided artifacts and LLM-generated findings, it contains an inherent surface for indirect prompt injection.
Ingestion points: The artifact path/content and JSON findings from reviewers enter the agent's context.
Boundary markers: Detailed prompt templates are used to instruct the reviewers, but no strict technical delimiters are applied to the artifact data itself.
Capability inventory: The skill has access to file system operations, command execution, and network cloning.
Sanitization: No automated sanitization is performed; the skill relies on the agent's logic to apply changes surgically and on human oversight of the output.
[SAFE]: The skill follows established patterns for plugin integration and reliability. It correctly identifies the trusted 'openai/codex-plugin-cc' repository for its external dependencies and implements a liveness watchdog to ensure autonomous operation without hanging.

multi-llm-convergence