Built-in review can recursively launch codex review through an inherited local skill

What variant of Codex are you using?

Codex App 26.715.31925 (build 5551) on macOS arm64, with codex-cli 0.144.6 installed by Codex Desktop.

What happened?

A built-in Codex review turn inherited a local review skill. The skill's broad description matched the review task and its helper launched codex review --base .... The new review turn inherited the same skill, selected it again, and launched another codex review.

I observed three consecutive nested review sessions/processes before stopping the process tree manually. The helper itself launched only once per process; the recursion came from each new review turn selecting the same inherited skill.

This needs two conditions to reproduce:

1. A local skill is eligible for review tasks and instructs Codex to invoke codex review.
2. A built-in review turn inherits that skill and has access to the command.

A broad local skill is the immediate trigger, but the host currently allows that mistake to recurse without a depth or re-entry guard.

Steps to reproduce

1. Add a local skill whose description matches code-review tasks.
2. Have the skill invoke codex review --base origin/main directly or through a helper.
3. Start a built-in review from Codex App.
4. Observe the review turn select the local skill and launch codex review.
5. Observe the child review repeat the same selection and command.

Expected behavior

A review turn should not be able to start another review indefinitely. Codex could refuse nested review entry, expose and enforce a review-depth marker, or prevent implicit review-launching skills from being selected inside an existing review.

Actual behavior

Each review can start another review. The chain continues until a user notices and kills it, consuming CPU, model usage, and duplicate work.

Source evidence

On current openai/codex main at bf3c1972b7d045c0a3a48dff91f381070f8f69e1, codex-rs/core/src/session/review.rs copies the parent skill snapshot into both review extension data (line 109) and the review turn's TurnSkillsContext (line 149). That matches the observed inheritance. I did not find a host-level nested-review guard in this path.

Local mitigation

I narrowed the local skill, set policy.allow_implicit_invocation: false, and added a process-tree depth guard to its helper. That stops this specific local path, but a host-level guard would protect users from any local skill or prompt that accidentally re-enters review.

Related but not duplicate: #16226 requests reliable parent/subagent identity in hook events. This report is specifically about built-in review re-entry and unbounded recursion.

I have not attached raw logs because the reproduction occurred against a private repository, but I can provide a sanitized trace if useful.