The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses codex exec to perform audits and planning by executing shell commands that interpolate variables like <target> and <findings>. The lack of sanitization for these inputs could allow for command injection if the repository being audited contains specially crafted filenames or if the audit findings are manipulated.
[COMMAND_EXECUTION]: The deployment logic (deploy.sh) uses powerful filesystem commands such as ln -sfn, mv -T, and a cleanup routine utilizing rm -rf. While standard for deployment, these operations are executed in the local environment and could be dangerous if paths are incorrectly resolved or maliciously influenced.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to how it processes data from external repositories and user tasks.
Ingestion points: Content of the target git repository, user task descriptions, and findings generated by the codex audit tool (which are derived from the repo files).
Boundary markers: None identified. Data is passed directly into prompts for the coder sub-agent and codex CLI without clear delimiters or instructions to ignore embedded commands.
Capability inventory: The pipeline has access to shell execution (codex exec), file system manipulation (deploy.sh), and the ability to trigger specialized sub-agents with full coding capabilities.
Sanitization: There is no evidence of escaping or validating external content before it is interpolated into subsequent prompts or shell commands.

dev-pipeline