The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses the codex exec --ephemeral command to execute a dynamically generated prompt file. This is performed to verify the model tier and reasoning capabilities of the environment. Generating and executing code at runtime is a potential vector for exploitation if the generation logic is compromised.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via the GitHub CLI (gh) to retrieve PR details, comments, and diffs, and to post review results. It also uses command -v to check for the existence of local binaries.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests large amounts of untrusted data from GitHub PRs and local context files.
Ingestion points: Pull request titles, bodies, and comments are fetched via gh pr view and gh api. Diffs are fetched via gh pr diff. Local context files are read from .dev/contexts/ using the Read tool.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when passing this untrusted data to the agent or external consultation tools.
Capability inventory: The skill has the ability to execute shell commands, read and write files, and post content to external GitHub repositories.
Sanitization: There is no evidence of sanitization or filtering applied to the PR content before it is processed for review or passed to sub-agents.

sanity-review