The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external sources (issue tracker comments, pull request bodies, and code diffs) while possessing the capability to execute commands and modify the repository.
Ingestion points: As described in SKILL.md, the agent reads full issues, PR bodies, comments, and diffs during the context gathering phase.
Boundary markers: No explicit delimiters or instructions to ignore embedded instructions within the ingested data are present in the skill instructions.
Capability inventory: The skill allows the agent to execute shell commands (SKILL.md, Step 3), write to the repository (SKILL.md, Step 5), and perform administrative actions on the issue tracker (labeling, commenting, and closing issues).
Sanitization: The instructions do not specify any validation, sanitization, or filtering of the external content before it is used in decision-making or command execution.
[COMMAND_EXECUTION]: The verification workflow in SKILL.md (Step 3) explicitly instructs the agent to "check it out, run the relevant tests or commands" when triaging a pull request. This poses a significant security risk, as a malicious contributor could submit a PR containing harmful code disguised as tests or implementation, which the agent would then execute in its environment.
[NO_CODE]: The skill does not contain any executable script files (e.g., Python or JavaScript); its logic is defined entirely within Markdown instructions and YAML configuration.

triage