The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands provided in SCOPE_METADATA (e.g., diff_command). This assumes the metadata is trustworthy and could be exploited if an attacker can influence the metadata contents to include malicious shell segments.\n- [DATA_EXFILTRATION]: The skill copies project source code into temporary directories under /tmp to perform the review. On multi-user systems, these files may be readable by other users, leading to unintended data exposure if the environment does not restrict access to temporary directories.\n- [PROMPT_INJECTION]: The skill mandates that SCOPE_METADATA be treated as 'authoritative' and override the agent's own reasoning or context, making the agent more susceptible to malicious instructions embedded in that metadata. Evidence Chain for Indirect Injection: 1. Ingestion point: SCOPE_METADATA processed in SKILL.md. 2. Boundary markers: None present. 3. Capability inventory: Use of Bash and Read tools. 4. Sanitization: No sanitization or validation of the input commands is described.

codex-reviewer