The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill identifies and reads files that are likely to contain sensitive information or hardcoded credentials as part of its security audit process.
Evidence: SKILL.md uses Glob("**/*{auth,login,password,token,secret,key,credential}*") to prioritize security-sensitive files for collection.
Evidence: references/codex-prompt-security.md instructs the agent to research sensitive operations using grep -r "password\\|secret\\|key" src/ -l.
[COMMAND_EXECUTION]: The skill uses shell commands to gather context about the project and retrieve code differences for the security review.
Evidence: SKILL.md executes git diff commands to collect uncommitted or recent code changes.
Evidence: references/codex-prompt-security.md specifies research instructions for the agent to execute grep and cat commands on the local file system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code changes by interpolating them directly into the security review prompt, creating an attack surface where instructions embedded in the code (e.g., in comments) could influence the reviewer's behavior.
Ingestion points: The ${CODE_CHANGES} variable in references/codex-prompt-security.md imports external code content into the agent context.
Boundary markers: Code is delimited by markdown code blocks, but there are no explicit instructions for the agent to ignore or isolate instructions found within the code changes.
Capability inventory: The skill is authorized to use Read, Grep, Glob, and Bash tools, which could be misused if an injection occurs.
Sanitization: No sanitization or filtering is applied to the code changes before they are interpolated into the security prompt.

security-review