The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute code from external, untrusted sources during the verification phase.
Evidence: In SKILL.md, under the 'Verify the claim' section (Step 3), the agent is explicitly told to "check it out, run the relevant tests or commands" for external Pull Requests.
Risk: An attacker can submit a Pull Request containing malicious code in the tests or build scripts, which the agent will then execute locally during triage.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from an issue tracker and uses it to influence sensitive actions.
Ingestion points: The agent reads issue and PR bodies, comments, and diffs as specified in SKILL.md (Step 1).
Boundary markers: The instructions lack boundary markers or warnings to ignore instructions embedded within the external data.
Capability inventory: The agent possesses the capability to execute shell commands (Step 3), invoke the Skill tool (Step 4), and write files to the .out-of-scope/ directory (Step 5).
Sanitization: There is no evidence of sanitization, validation, or filtering of the external issue/PR content before it is processed.
[COMMAND_EXECUTION]: The skill performs shell-based operations based on input and code provided by external authors.
Evidence: The verification step involves running arbitrary commands and tests defined in the PR's codebase.

triage