The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill invokes the codex exec tool using the --full-auto flag, enabling autonomous command execution based on model output. When this tool processes untrusted content from commits or pull requests, it creates a vector for code execution vulnerabilities through the autonomous shell execution capability.
[COMMAND_EXECUTION]: The skill utilizes git, gh, and codex commands to interact with local and remote repositories. It specifically instructs the codex tool to execute its own git commands (such as git diff and git show) to fetch data, granting an external AI model indirect control over the local command environment.
[EXTERNAL_DOWNLOADS]: The skill relies on the @openai/codex package from the NPM registry. This package serves as the core execution engine for the code review process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests unverified data from source files, branches, and pull requests to be analyzed by an AI-driven autonomous tool.
Ingestion points: PR URLs, commit SHAs, file paths, and user-specified 'focus areas' in SKILL.md.
Boundary markers: The instructions use heredoc syntax for prompt delivery but lack explicit delimiters or warnings to prevent the analysis tool from obeying instructions embedded within the code being reviewed.
Capability inventory: Uses codex exec --full-auto, gh pr view, and git across SKILL.md and references/prompt-template.md.
Sanitization: Employs shell quoting for variables and heredoc structures, which protects against basic command injection but not against content-level prompt injection that targets the tool's autonomous logic.
[DYNAMIC_EXECUTION]: The skill employs a multi-round adversarial debate protocol in references/debate-protocol.md that involves generating and evaluating code analysis findings at runtime. This logic includes a reversed-role debate where findings are dynamically generated by the agent to stress-test the external tool's responses.

codex-code-review