The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically resolves and executes a 'Codex companion' script from the user's home directory. A helper script (scripts/resolve-codex.py) searches the .claude/plugins/cache/ and marketplaces directories for codex-companion.mjs. If found, this script is executed via node to handle reviewer passes and implementation tasks. Executing code from computed paths increases the risk of executing unintended or malicious files if the environment is not strictly controlled.
Evidence: The Python script scripts/resolve-codex.py uses HOME.glob() to locate the companion script and subprocess.run() to execute it.
Evidence: Instructions in references/reviewers/codex.md and references/modes/codex-impl.md describe executing the discovered script through the command line.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes issue details and comments from external platforms (GitHub, GitLab, Jira, Linear) to generate plans and implementation code. This ingestion of untrusted data from remote sources creates a potential for indirect prompt injection if an attacker inserts malicious instructions into a public issue comment.
Ingestion points: Issue and comment fetching in references/trackers/github.md, references/trackers/gitlab.md, references/trackers/jira.md, and references/trackers/linear.md.
Boundary markers: The skill structures the plan for user review but does not explicitly sanitize the source text to prevent embedded instruction following.
Capability inventory: The skill has file-write, command execution (git, bash), and Node.js execution capabilities.
Sanitization: No specific filtering or escaping of comment data is defined.
Mitigation: The skill implements a mandatory Step 6 'Gate' requiring explicit user approval of the proposed plan before implementation begins.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution to manage git repositories, run tests, and interact with host-specific CLI tools like gh and glab.
Evidence: Automated branching, commit assembly, and CI status polling involve numerous subprocess calls.
[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with the GitHub and GitLab REST APIs as a fallback when local CLI tools are missing or unauthenticated.
Evidence: API fetch commands in references/trackers/github.md and references/trackers/gitlab.md.
Status: These operations target well-known, trusted developer services and do not escalate the verdict.

forge