The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically resolves the path to the codex-companion.mjs script at runtime by searching the $HOME/.claude/plugins/cache/openai-codex/codex directory using a glob and sorting. It then executes this dynamically-resolved script via Node.js, which is a medium-risk pattern for dynamic loading from computed paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from code diffs and GitHub metadata, which could contain malicious instructions designed to influence the agent. 1. Ingestion points: Git diffs (git diff) and GitHub PR information (gh pr view). 2. Boundary markers: Absent; no delimiters or warnings to ignore instructions within the code data are provided. 3. Capability inventory: Extensive Bash access (git, gh, node, timeout) and the ability to call other skills. 4. Sanitization: Absent; no filtering or escaping of the ingested code content is performed.
[COMMAND_EXECUTION]: The skill constructs shell commands by interpolating variables such as $BASE and $LOGDIR which are derived from external inputs (PR numbers, branch names) or environment resolution. This pattern presents a risk of command injection if the agent does not strictly validate these inputs before shell execution.

codex-review