The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/autoreview executes arbitrary user-provided strings via bash -lc "$parallel_tests". This allows for unvalidated shell command execution.
[COMMAND_EXECUTION]: The skill automatically executes pnpm run check if it detects a Node.js project structure, which runs scripts defined in the local package.json file.
[COMMAND_EXECUTION]: The skill defaults to running codex review with the flags --dangerously-bypass-approvals-and-sandbox and --sandbox danger-full-access. This is a deliberate attempt to circumvent security sandboxes and platform-level approval prompts.
[DATA_EXFILTRATION]: The skill collects code diffs, including untracked files, and transmits this information to external AI services (e.g., Anthropic, Microsoft, Pi) through their respective CLI tools for analysis.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted data (code diffs) and interpolating it into prompts sent to secondary AI reviewers.
Ingestion points: The diff_for_review function in scripts/autoreview captures output from git diff, git show, and git ls-files.
Boundary markers: The build_prompt_file function uses only a simple Diff: header to separate code from instructions, which is insufficient to prevent data from being interpreted as commands.
Capability inventory: The skill has access to the shell, git, GitHub CLI, and various AI model binaries.
Sanitization: No escaping or sanitization is performed on the repository diffs before they are included in the prompt.

autoreview