The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to invoke the codex CLI with an explicit configuration flag (-c 'sandbox_permissions=...') that requests disk-full-read-access, disk-full-write-access, and network-full-access. This configuration attempts to elevate the tool's permissions beyond the standard restricted environment, granting it unrestricted access to the local system and network.
[DATA_EXFILTRATION]: By granting the external CLI both disk-full-read-access and network-full-access, the skill creates a direct capability for the exfiltration of sensitive local data (such as credentials, source code, or configuration files) to external servers.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute an external binary (codex) and provides specific command-line arguments that enable high-privilege operations and file system interaction.
[DYNAMIC_EXECUTION]: In Step 2 and Step 3, the skill dynamically generates a temporary instruction file (/tmp/codex-review-instructions.md) and then instructs the CLI to execute its review process based on the content of this generated file. This creates a risk if the instructions are influenced by malicious data.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it ingests untrusted data from the repository's code diffs and incorporates that data into the instructions for the external reviewer.
Ingestion points: Code diffs and lists of changed files retrieved in Step 1 from the local repository.
Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple backticks) or "ignore instructions" headers when interpolating the diff content into the instruction file.
Capability inventory: The skill has access to the Bash tool and grants the codex process full network and disk read/write permissions.
Sanitization: There is no mention of sanitizing, escaping, or validating the content of the diffs before they are written to the instruction file.

codex-review