The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to compile comprehensive project context by reading local files such as STORY.md, README.md, paper drafts, and experimental results. This sensitive information is then transmitted to an external service using the mcp__codex__codex tool. While this is the stated purpose of the skill, it represents a data exposure risk as it sends potentially proprietary research data to a third-party endpoint not associated with a known trusted provider.
[COMMAND_EXECUTION]: The prerequisites section explicitly instructs the user to run a command (claude mcp add codex -s user -- codex mcp-server) that installs and configures a third-party software component. The source of codex mcp-server is not verified, and executing installation scripts for unverified software is a significant security risk.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from various research documents and interpolates them directly into prompts for an external LLM without adequate protection.
Ingestion points: Reads project narratives (STORY.md, README.md), drafts, and memory/notes files.
Boundary markers: None identified. The prompt templates lack delimiters or instructions to ignore embedded commands within the research text.
Capability inventory: The skill possesses Read, Write, Edit, and Bash(*) capabilities, which could be exploited if the agent follows malicious instructions hidden in the research documents.
Sanitization: No sanitization or validation of the ingested file content is performed before transmission.

aris-research-review