The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using unsafe interpolation of file contents and variables. Specifically, the patterns $(cat REVIEW_PROMPT) and $THREAD_ID are used within shell command strings. If the content of the REVIEW_PROMPT file or the THREAD_ID variable contains shell metacharacters (such as backticks, semicolons, or pipes), it could lead to arbitrary command execution on the host system. The use of 2>/dev/null further obscures potential errors or malicious activity during execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes a feedback loop where an external model (Codex) reads repository files and its output is used by the agent to modify the project plan. This creates a surface for indirect prompt injection where malicious content in the repository could influence the critique to inject instructions that the agent might unknowingly follow. \n
Ingestion points: PLAN.md, repository files, and the model critique in /tmp/codex-verdict.txt. \n
Boundary markers: No explicit delimiters or boundary warnings are provided to isolate untrusted data. \n
Capability inventory: Execution of the codex CLI and file system writes to project files. \n
Sanitization: There is no evidence of sanitization or escaping of the external critique before it is processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill requires an external dependency, the codex CLI tool. The skill does not provide a verified source or installation method for this tool, which is not a standard system utility. This introduces a risk of executing malicious binaries if a non-official version is installed.\n- [DATA_EXFILTRATION]: By design, the skill reads repository files and the implementation plan, transmitting this data to an external service (OpenAI Codex) for review. While this is the primary function of the skill, it represents a broad exposure of sensitive codebase information to a third-party provider.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs shell commands based on runtime data, such as the THREAD_ID parsed from a previous command's output. The absence of validation for this identifier before its use in the codex exec resume command allows for potential runtime code injection if the identifier is manipulated.

codex-review