The Agent Skills Directory

[COMMAND_EXECUTION]: The skill exhibits several command injection vulnerabilities where variables are interpolated into shell strings without sanitization. In Step 1, user-provided model arguments (e.g., from /codex-review gpt-5.4) are used directly in the codex exec -m command. In Step 4 and 6, the CODEX_SESSION_ID is extracted from the stdout of the codex tool (which processes untrusted git diffs or plans) and then passed to codex exec resume ${CODEX_SESSION_ID}. An attacker could embed malicious strings in a code diff that trick the tool into outputting a payload which then executes on the host system during the resume step.
[EXTERNAL_DOWNLOADS]: The skill requires the global installation of a non-standard NPM package @openai/codex (npm install -g @openai/codex). Users should verify the supply chain security of this package before installation as official OpenAI CLI tools are typically distributed through different naming conventions.
[COMMAND_EXECUTION]: The skill hardcodes local proxy environment variables (https_proxy=http://127.0.0.1:7890) for its network operations. This forces the agent to route all external review data through a specific local port, which may be inappropriate for the user's environment or could be used to intercept sensitive code data if a malicious proxy is active on that port.

codex-review