The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection. It ingests untrusted data from source code, test files, and request documents (Acceptance Criteria), and interpolates this content into prompts for the Codex LLM. While it uses markdown headers for organization, it lacks explicit boundary markers or sanitization to prevent the agent from obeying instructions embedded within the processed project files.
Ingestion points: Processes external files such as ${REQUEST_PATH}, ${SOURCE_CONTENT}, and ${TEST_CONTENT} within prompts defined in references/codex-prompt-test-review.md and references/codex-prompt-ac-trace.md.
Boundary markers: Absent; uses standard markdown structures which can be easily subverted by embedded content.
Capability inventory: The agent has access to Write, Bash, and Read tools, providing a pathway for exploitation if malicious instructions are obeyed.
Sanitization: No evidence of sanitization or escaping of external content before interpolation into prompts.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts to validate results and manage the review workflow. It specifically uses the Bash(node:*) tool to run node scripts/validate-family-sentinel.js and references scripts/lib/review-dispatch.js. These are vendor-provided resources from the author 'sd0xdev' and are part of the intended logic for report validation and review dispatching.
[REMOTE_CODE_EXECUTION]: The /codex-test-gen command generates unit test code and saves it to the local file system. While the skill does not automatically execute the generated code (it suggests a manual /verify), the generation of executable scripts from LLM output is a recognized pattern for code generation skills.

test-review