The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/context.sh employs eval "$lint" to run a command string built from user-provided arguments. This behavior facilitates the execution of arbitrary shell commands if the input is manipulated.
[DYNAMIC_EXECUTION]: The use of eval to process and execute strings as commands at runtime is a dynamic execution pattern that increases the attack surface for command injection and complicates security auditing.
[DATA_EXFILTRATION]: The script scripts/context.sh reads and displays the content of files at paths specified by the target and state arguments (e.g., cat "$state/notes"). This could be exploited to expose the contents of arbitrary or sensitive files if the agent is directed to use unauthorized paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external content from target documents and workflow notes to perform its tasks. Because this content is not sanitized or escaped, it represents a surface for indirect prompt injection where adversarial text could override agent instructions.
Ingestion points: The content of the file specified by the target argument and the review notes in $state/notes are read directly into the agent's context.
Boundary markers: The script uses simple text headers (e.g., == findings ==) to delimit sections, which do not provide robust isolation against malicious content mimicking these markers.
Capability inventory: The agent possesses the capability to modify the filesystem using the apply_patch tool and to execute shell commands through the context.sh script.
Sanitization: There is no evidence of sanitization, validation, or escaping of the ingested file content to prevent instruction injection.

codex-write-prose-fix