codex-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In codex-review.sh, the required workflow passes PROMPT (including --focus/--focus-file free text) plus repository content/diff/plan into codex exec ... "$PROMPT" for the LLM to read and generate a verdict.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly recommends changing a kernel sysctl (kernel.apparmor_restrict_unprivileged_userns=0) to fix sandboxing, which is a privileged system configuration change that modifies host state and can require root/sudo.