The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses the --full-auto flag and mentions the --sandbox danger-full-access flag for the Codex CLI. These flags are designed to bypass user approval for file reads, writes, and command execution, granting the agent high autonomy and removing standard safety boundaries for automated operation.
[DYNAMIC_EXECUTION]: The helper script scripts/review.sh uses the eval command to execute a dynamically constructed shell command string (eval "$cmd" "\"$prompt\""). This pattern can be dangerous if the input variables are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface.
Ingestion points: The skill ingests untrusted data from external sources such as git diffs, directory contents, and Pull Request diffs fetched via the GitHub CLI (gh pr diff).
Boundary markers: There are no explicit delimiters or instructions provided to the model to ignore embedded instructions within the code being reviewed.
Capability inventory: The skill has the capability to read any file in the workspace and execute shell commands through the Codex CLI integration.
Sanitization: There is no evidence of sanitization or filtering of the external code content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Codex CLI via npm install -g @openai/codex or brew install --cask codex. These are official packages from a recognized organization.

codex-code-review