The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute reproduction steps provided by external issue reporters. This provides a direct path for executing arbitrary and potentially malicious commands within the agent's environment.\n
Evidence: Found in SKILL.md section 'Verify the claim': "reproduce it from the reporter's steps."\n- [REMOTE_CODE_EXECUTION]: The agent is directed to check out code from external pull requests and execute associated tests or commands. This involves the execution of untrusted code from remote contributors.\n
Evidence: Found in SKILL.md section 'Verify the claim': "confirm the diff does what it claims: check it out, run the relevant tests or commands."\n- [DYNAMIC_EXECUTION]: The skill involves the runtime execution of code found in PR diffs or described in issue comments to verify bug reports and feature implementations.\n
Evidence: Found in SKILL.md under the 'Verify the claim' workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub issues and pull requests, including bodies, comments, and code diffs. These inputs are used to influence the agent's actions, such as generating briefs and executing commands, without explicit sanitization or boundary markers.\n
Evidence Chain:\n
Ingestion points: Issue/PR bodies, comments, labels, and diffs are read (referenced in SKILL.md).\n
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing reporter content.\n
Capability inventory: The skill has the ability to execute shell commands (via git/gh/test runners), write to the repository (.out-of-scope/ directory), and post comments externally.\n
Sanitization: No sanitization or validation of the untrusted data is described before it is used for command execution or brief generation.

triage