The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent in SKILL.md to "check out" and "run the relevant tests or commands" when verifying external Pull Requests. This is a significant security risk as an attacker can submit a PR containing malicious code within the tests or build scripts that will be executed on the agent's host environment during the verification process.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it ingests untrusted data from GitHub to generate "Agent Briefs," which are intended to be authoritative contracts for other agents.
Ingestion points: Reads the full context of issues and PRs (bodies, comments, and diffs) as described in SKILL.md (Step 1: Gather context).
Boundary markers: There are no instructions to use boundary markers or delimiters to separate untrusted reporter content from the agent's logic or to ignore embedded instructions within the data.
Capability inventory: The agent has the capability to execute shell commands/tests, write to the repository's .out-of-scope/ directory, update CONTEXT.md and ADRs, and post comments back to GitHub.
Sanitization: The skill lacks any requirement to sanitize, escape, or validate external content before interpolating it into documentation or downstream instructions.
[COMMAND_EXECUTION]: The "Verify the claim" step in SKILL.md directs the agent to reproduce bugs from reporter-provided steps and run commands found in PRs, which leads to the execution of arbitrary, potentially harmful commands in the terminal.

triage