The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow where the agent ingests findings from the codex review CLI tool and uses them to automatically modify source code in the Fix phase. This creates a surface where malicious code within a repository could potentially influence the reviewer's output to induce the agent to perform harmful edits.
Ingestion points: The agent parses the standard output of the codex review command (SKILL.md, 'Codex 输出判断' section).
Boundary markers: The instructions recommend identifying the 'last complete reviewer conclusion' but do not define strict delimiters or 'ignore embedded instructions' warnings for the tool output.
Capability inventory: The agent has the ability to execute git and codex commands and perform arbitrary file writes in the target repository path.
Sanitization: No explicit sanitization or content filtering of the review findings is described before the agent acts on them.
[COMMAND_EXECUTION]: The skill generates shell commands by interpolating user-provided inputs such as project paths, branch names, and commit SHAs.
Evidence: Commands like codex -C <project-path> review --uncommitted, codex review --base <branch>, and codex review --commit <sha> are used (SKILL.md, '原生 CLI 命令' section).
Mitigation: The skill includes pre-flight check instructions to verify that the project path is a valid Git repository and that branches/SHAs are resolvable, which reduces the risk of accidental or malicious command injection.

codex-review-fix-loop