The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill parses and processes review findings from markdown files generated in the .agent/reviews/ directory. These findings are used to automate code fixes and create backlog tasks, creating a surface where malicious instructions in the code being reviewed could influence agent actions.
Ingestion points: Markdown files at .agent/reviews/review-<timestamp>.md as referenced in SKILL.md and references/codex-cli-reference.md.
Capability inventory: The skill performs git add and git commit --amend operations and executes the backlog task create command based on the ingested content.
Boundary markers: The workflow uses a 3-cycle circuit breaker, but it lacks explicit instruction boundaries or delimiters to prevent the agent from following instructions embedded within the review text itself.
Sanitization: There is no evidence of input validation or escaping for the suggested fix and issue description fields before they are interpolated into the --plan and -d arguments of the backlog CLI tool.

codex-code-review