The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/ask_codex.mjs executes the codex CLI tool using spawnSync. This functionality relies on the codex binary being present in the user's environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests recent conversation history from a transcript file to provide context for the review. This creates an attack surface where instructions embedded in previous user or assistant messages could influence the reviewer model's behavior.
Ingestion points: scripts/ask_codex.mjs reads the file specified by the --transcript CLI argument.
Boundary markers: The script uses <recent-conversation> and <question> XML-style tags to delimit the context within the final prompt.
Capability inventory: The reviewer model is executed via the codex tool with a --sandbox read-only flag, which aims to prevent state-mutating actions like file writes or network calls during the review process.
Sanitization: The script filters the transcript for specific JSON message types and truncates long strings, but it does not perform sanitization of the underlying text content to prevent prompt injection.- [DATA_EXFILTRATION]: The skill reads the conversation history, which may contain sensitive project information or credentials, and passes it to the codex tool for analysis. Depending on the codex tool's configuration, this data may be sent to a remote model provider.

codex-advisor