The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/parallel_reviews.sh is vulnerable to command or argument injection. It uses bash -c inside an xargs call to execute the codex command, interpolating environment variables like PARALLEL_REVIEW_REASONING directly into the shell string. Maliciously crafted input in the --reasoning-effort argument can break out of the intended command structure.
Evidence: scripts/parallel_reviews.sh lines 101-112, specifically the expansion of $PARALLEL_REVIEW_REASONING inside the bash -c block.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface. It ingests PR review data—which includes code and comments from potentially untrusted PRs—and asks the agent to "Deduplicate and validate all the findings" and create an "execution plan to fix valid findings." An attacker could include malicious instructions in code comments to influence the agent's synthesis or the resulting fix plan.
Ingestion points: The workflow in SKILL.md specifies reading review blocks containing PR content.
Boundary markers: There are no explicit delimiters or instructions to treat the review data as untrusted or to ignore embedded instructions.
Capability inventory: The skill can execute shell scripts and access repository files.
Sanitization: No sanitization or escaping of the PR content is performed before the agent processes it.
[COMMAND_EXECUTION]: The skill relies on an external, non-standard CLI tool named codex for its core functionality.
Evidence: scripts/parallel_reviews.sh line 105: codex e review --json ....
[DATA_EXFILTRATION]: The script interacts with the GitHub CLI (gh) and Git metadata to detect branch names, which involves accessing repository state and potentially utilizing local authentication tokens.
Evidence: scripts/parallel_reviews.sh lines 58 and 67.

parallel-codex-pr-review