The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes code content which could contain malicious instructions designed to manipulate the agent's review or recommendations.
Ingestion points: The agent reads code changes via git diff and accesses specific files within the repository.
Boundary markers: The prompt uses task-specific headers (e.g., 'Scope:') but does not implement robust delimiters or instructions to ignore embedded commands within the code being analyzed.
Capability inventory: The agent generates review reports, provides fix recommendations, and makes approval decisions (APPROVE/REQUEST CHANGES).
Sanitization: There is no evidence of sanitization or filtering of the code content before it is processed by the agent.
[DATA_EXFILTRATION]: The skill implements a validation protocol that transmits project source code to a remote 'Codex' service using the mcp__x__ask_codex tool. This is a documented feature of the vendor's 'oh-my-codex' workflow, but it involves sending potentially sensitive intellectual property to an external endpoint.
[COMMAND_EXECUTION]: The skill utilizes the git diff command to identify changes for review. This is a standard and expected operation for the skill's stated purpose.

code-review