The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/run-review.mts script includes a fallback mechanism for the codex reviewer. When the standard platform sandbox (bubblewrap) cannot be initialized, the script executes codex with the --sandbox danger-full-access flag. This action explicitly disables the model's internal security constraints, relying solely on a temporary filesystem snapshot for isolation, which does not prevent the model from executing arbitrary commands on the host.
[CREDENTIALS_UNSAFE]: The scripts/run-review.mts script accesses the user's sensitive auth.json file (containing authentication tokens) from the CODEX_HOME directory. It copies this file into a temporary scratch directory in /tmp to allow the reviewer model to operate with the user's identity. This practice exposes sensitive credentials in a temporary location and handles them outside of their primary secure storage.
[COMMAND_EXECUTION]: The skill's primary script uses node:child_process to spawn external reviewer binaries (codex, claude, copilot). While it avoids shell interpolation by passing arguments in an array, the reviewer models themselves possess capabilities to execute shell commands and read files, which becomes a security concern when sandboxing is disabled.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads and processes untrusted data in the form of repository files and Git diffs during the review process (referenced in SKILL.md and scripts/run-review.mts).
Boundary markers: The instructions recommend including defensive prompt prefixes (e.g., "This is a review-only task. Do not edit, write, or modify any files.") to mitigate model misbehavior.
Capability inventory: The reviewer models have the ability to read the filesystem and execute commands.
Sanitization: The skill does not implement sanitization or filtering of the code content before providing it to the reviewer model.
Evidence: The combination of processing untrusted code and the optional disabling of the codex sandbox creates a significant surface for indirect prompt injection attacks where a malicious code file could trigger unauthorized actions on the user's machine.

rubber-duck-review