The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to process untrusted external data like patch files and PR descriptions, which could contain adversarial instructions. (1) Ingestion points include patch content, tickets, and PR bodies mentioned in SKILL.md. (2) Boundary markers are provided as instructions to treat all text as evidence rather than workflow instructions. (3) Capability inventory includes the execution of patch code and a local validation script. (4) Sanitization is addressed through mandatory isolation rules for code execution.
Dynamic Execution of Untrusted Content: The assessment process allows for running code from a patch to verify behavior. The skill instructs the agent to run subject-controlled code in isolated, disposable workspaces. This represents a security surface as it involves executing logic from external sources, though it is gated by explicit constraints to disable network and credential access.
Local Command Execution: The skill references a local utility for validating results. It calls a bundled script, launch_codex_security_mcp, to verify the assessment JSON. This is a controlled execution of a tool distributed within the skill's environment.

assess-patch-risk