The Agent Skills Directory

[DATA_EXFILTRATION]: The skill gathers project narrative documents, README files, paper drafts, and experiment history files to send them to an external LLM via the mcp__codex__codex tool. This creates a data exfiltration path for potentially sensitive intellectual property or research data.
[EXTERNAL_DOWNLOADS]: The prerequisite section instructs the user to install an unverified MCP server using the command codex mcp-server. This represents a dependency on an external, non-standard package from an unknown source.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It reads untrusted content from research files and interpolates it directly into the prompt sent to the Codex tool.
Ingestion points: Reads project files (STORY.md, README.md, paper drafts, memory/notes) in SKILL.md Step 1.
Boundary markers: None. The files are compiled into a 'detailed briefing' and sent in Round 1 without delimiters or safety warnings for the recipient model.
Capability inventory: The skill uses mcp__codex__codex and mcp__codex__codex-reply to communicate externally, and Write/Edit to modify local files based on the external model's output.
Sanitization: No sanitization is performed on the content of the research files before they are sent to the external service.
[COMMAND_EXECUTION]: The skill requests Bash(*) permissions and provides an installation command for a local server, which could lead to unauthorized command execution if the server package is malicious.

research-review