The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted repository content for code analysis and adversarial review tasks.
Ingestion points: Untrusted data enters the agent context through git diff outputs, file reads, and stdin redirection in codex exec and codex review commands as described in SKILL.md and references/code-review.md.
Boundary markers: The skill uses template-based prompts in references/adversarial-review-prompt.md with XML-style tags like <repository_context> and <task> to separate untrusted data from instructions.
Capability inventory: The skill documents the use of the codex CLI which, depending on the sandbox mode (workspace-write or danger-full-access), can modify the filesystem or perform network operations as shown in the SKILL.md usage patterns.
Sanitization: The skill relies on the internal security mechanisms and sandbox modes of the external codex-cli tool (e.g., --sandbox read-only) rather than performing its own data sanitization.
[COMMAND_EXECUTION]: The skill's primary functionality is built upon the execution of several shell commands to manage repository state and interface with the Codex CLI.
Evidence: The instructions in SKILL.md and references/code-review.md direct the agent to use git status, git diff, git symbolic-ref, and various codex subcommands.
Context: These commands are necessary for the skill's stated purpose of delegating coding tasks and are used within a standard development workflow context.

codex-cli