codex-cli-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly grants "disk-full-read-access" and invokes the codex CLI to review the repository, which intentionally enables sending the full project (including secrets/configs) to an external service — a high-risk data exfiltration/credential exposure pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path runs scripts/review.sh, which ingests the outsider-provided --prompt free text via echo "$CUSTOM_PROMPT" | eval "$CMD" - into codex review, making injection possible through that prompt input.