The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by automating code reviews and bug fixes on untrusted third-party inputs.
Ingestion points: Untrusted data enters the agent context through cloning external git repositories (git clone) and pulling external pull requests (gh pr checkout, git diff) in SKILL.md under the 'PR Reviews' and 'Parallel Issue Fixing' sections.
Boundary markers: There are no boundary markers or clear prompt isolations implemented to prevent the underlying LLM from executing malicious commands embedded within the fetched code or PR descriptions.
Capability inventory: The skill utilizes the terminal tool to run administrative and development operations, including execution of the codex CLI, file modification, and repository writes.
Sanitization: The instruction set lacks any validation, filtering, or sanitization workflows for external files prior to passing them to the execution environment.
[COMMAND_EXECUTION]: The skill guides the execution of shell commands through the terminal tool that consciously lower security controls. It instructs the agent to utilize flags such as --sandbox danger-full-access and --dangerously-bypass-approvals-and-sandbox to avoid environment compatibility errors, effectively disabling the application's built-in sandbox boundaries.

codex