The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via the codex exec CLI and bash scripts to perform file analysis, git history inspection, and apply code changes. It specifically uses grep and git log to search for sensitive patterns across the repository.
[DATA_EXFILTRATION]: Includes a 'Secrets Archaeology' phase (references/security-audit.md) designed to discover and extract sensitive information such as AWS access keys, GitHub personal access tokens, and private keys. While intended for security reporting, this constitutes automated exposure of highly sensitive credentials.
[REMOTE_CODE_EXECUTION]: Utilizes the codex exec tool to run logic generated by remote AI models directly on the local filesystem. When operating in 'fix' mode, the skill grants the model workspace-write permissions to modify source code files.
[CREDENTIALS_UNSAFE]: Contains explicit patterns and regular expressions in references/security-audit.md to detect hardcoded secrets, including tokens with prefixes like AKIA, sk-, ghp_, and xoxb-.
[PROMPT_INJECTION]: The SKILL.md file contains instructions telling the agent to treat file lists as 'locators' rather than 'scope locks' and explicitly commands the model to 'not limit findings to the listed paths' and to 'ignore scope locks'. These patterns match common injection techniques used to bypass constraints.
[EXTERNAL_DOWNLOADS]: Requires the installation of the @openai/codex package from the NPM registry. This package is provided by a well-known technology service.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes arbitrary source code from the user's repository during reviews.
Boundary markers: Uses XML tags like <task> and <context> to delimit input, but these do not prevent a malicious code file from attempting to influence the reviewer's behavior.
Capability inventory: The agent has the authority to execute shell commands and write to the workspace (workspace-write).
Sanitization: There is no documentation of sanitization or escaping of the code content before it is interpolated into the prompts sent to the review models.

codex-review