The Agent Skills Directory

[COMMAND_EXECUTION]: The argument parsing logic in SKILL.md iterates over the $ARGUMENTS variable in a bash block. Since the variable is expanded by the shell without quoting or sanitization, it allows for arbitrary command execution if a user provides input containing shell metacharacters such as ;, $(...), or backticks.
[EXTERNAL_DOWNLOADS]: The skill attempts to fetch and run the codex package from the NPM registry using npx -y codex. This package uses an un-scoped name that differs from the @openai/codex package referenced in the documentation, creating a risk of dependency confusion or typosquatting where a malicious package could be executed instead of the intended tool.
[REMOTE_CODE_EXECUTION]: The use of npx to dynamically download and execute remote code at runtime, without version pinning or cryptographic integrity checks, introduces a remote code execution vector that could be exploited if the package registry or the specific package is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it automates software development based on untrusted content from GitHub issues and pull requests. A malicious issue description could be used to influence the agent's behavior during the implementation or review phases.
Ingestion points: Untrusted data is fetched from GitHub issues and PR diffs via CLI tools.
Boundary markers: The skill does not use delimiters or specific instructions to isolate external data from the agent's core implementation logic.
Capability inventory: The skill has access to high-privilege tools including Bash, Write, Edit, and the ability to push code to remote repositories.
Sanitization: External content is not sanitized or validated before being passed to subagents for design and implementation tasks.

complete-issue