The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes full Bash(*) access to implement code changes, execute experiments, and run the codex exec tool. In its most adversarial mode, it instructs an external model to explore the repository freely using shell execution.\n- [DATA_EXFILTRATION]: The skill accesses the file ~/.claude/feishu.json to configure external notifications. Reading configuration or credential files from hidden directories in the user's home folder is a significant data exposure risk.\n- [PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection as it automatically implements code modifications suggested by an external AI model.\n
Ingestion points: Responses from the mcp__codex__codex tool and the AUTO_REVIEW.md log file.\n
Boundary markers: None; instructions are treated as verified tasks for implementation.\n
Capability inventory: Access to Bash(*), Write, and Edit tools allows for arbitrary file and system modifications.\n
Sanitization: The skill lacks any sanitization or verification mechanism for the code changes suggested by the external model.\n- [PROMPT_INJECTION]: The skill allows the $ARGUMENTS variable to override critical constants like HUMAN_CHECKPOINT. This enables the execution of the autonomous loop without any user intervention or review of the proposed changes.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests using curl to fetch research citations from dblp.org and doi.org.

aris-auto-review-loop