The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted source code, creating a surface for indirect prompt injection attacks where malicious instructions in the reviewed code could influence the agent's behavior.
Ingestion points: The skill accesses the full project codebase using tools such as codex_read_file, read_file, and codex_grep (documented in SKILL.md and agents/openai.yaml).
Boundary markers: Absent. The system prompt in agents/openai.yaml does not include specific delimiters or instructions to ignore or isolate embedded prompts within the source code being analyzed.
Capability inventory: The agent has access to the bash tool and is configured to execute shell commands including cargo check, npm audit, and python -m py_compile (documented in agents/openai.yaml and SKILL.md).
Sanitization: Absent. There is no explicit logic described to sanitize code content or validate that analysis tools are not being misdirected by content within the files.
[COMMAND_EXECUTION]: The skill utilizes shell commands and the bash tool to perform code analysis tasks, which is a powerful capability that requires monitoring.
Evidence: SKILL.md specifies the use of cargo check, cargo clippy, npm audit, python -m py_compile, and rustfmt for validation. The agents/openai.yaml file explicitly includes the bash tool in its allowed tools list.

code-reviewer