The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources which could contain malicious instructions designed to subvert the agent's logic.
Ingestion points: Fetches human and Copilot review findings, inline threads, and existing replies from a GitHub Pull Request (SKILL.md Step 1).
Boundary markers: The instructions include explicit safeguards, commanding the agent to "Independently establish whether the suggested issue is real before acting on it" and to "not rely on the review author's confidence, status, or reasoning as proof" (SKILL.md Step 2).
Capability inventory: The skill has the ability to execute code via tdd, write files to the project directory, and post replies or resolve threads via the GitHub API (SKILL.md Steps 3, 4, 5).
Sanitization: No specific sanitization or escaping of the fetched PR content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is designed to execute local development tools, which can be exploited if the code being tested is malicious.
Evidence: The instructions require invoking tdd to run "focused tests" and using "repository's coverage tooling" to verify fixes (SKILL.md Step 3). Since these tests may be part of an external Pull Request, they represent a vector for executing arbitrary code in the agent's environment.

triage-pr-feedback