The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the repository, including code diffs and file contents, through git diff and cat commands. This data is interpolated into prompts for the AI reviewer, creating a vulnerability surface where malicious code could influence the agent's behavior.
Ingestion points: Files and diffs are read from the local repository as specified in references/codex-research-instructions.md and SKILL.md Step 1.
Boundary markers: Prompt templates in the references/ directory use Markdown headers (e.g., ## Changed Files, ## Diff Stats) to separate instructions from untrusted code data.
Capability inventory: The skill has access to Bash (git, node, and project scripts), Task (subagent invocation), and MCP Codex (read-only filesystem access).
Sanitization: The skill relies on prompt-level instructions for the AI to 'Deliberate' and perform 'Evidence checks' and 'False positive checks' rather than programmatically sanitizing the code inputs.
[COMMAND_EXECUTION]: The skill relies on the execution of several local project scripts (scripts/resolve-feature.sh, scripts/lib/review-dispatch.js, scripts/validate-family-sentinel.js, and scripts/review-state.js) using bash and node. The skill configuration grants broad Bash(bash:*) permissions, which the documentation acknowledges as 'broader than ideal'. Although targeted at project scripts, this permission level allows the execution of any bash command if the logic is compromised.

codex-code-review