The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to dynamically construct shell commands for the codex CLI using strings provided in the user's trigger message (e.g., model names and reasoning effort values). If the user provides a maliciously crafted string designed to escape the command context (e.g., using semicolons or backticks), it could lead to arbitrary command execution on the local system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because its core function is to have an AI analyze untrusted files from a project codebase. If an attacker places malicious instructions inside these files, they could influence the agent's behavior or the outcome of the consensus process.
Ingestion points: Local source code files, configuration files, and implementation plans discussed in the session.
Boundary markers: The instructions lack explicit delimiters or warnings to the AI to ignore instructions embedded within the analyzed data.
Capability inventory: The skill has access to shell execution (codex exec) and filesystem read operations.
Sanitization: There are no instructions for sanitizing or validating the content of the files before they are processed by the agent or the CLI.
[DATA_EXFILTRATION]: The skill accesses sensitive configuration paths in the user's home directory (~/.codex/config.toml and ~/.codex/sessions/). While these are necessary for the tool's operation, the exposure of these paths to the agent's context and the potential for their contents (which may include API keys) to be included in prompts represents a data exposure risk.

codex-review