The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to check out external pull requests and execute their code (e.g., tests or related commands) to verify functionality (SKILL.md, Step 3: 'checkout ออกมา รัน test หรือคำสั่งที่เกี่ยวข้อง'). This allows an external attacker to execute arbitrary malicious code on the agent's runner by providing it in a PR.
[COMMAND_EXECUTION]: The skill workflow involves executing shell commands derived from instructions within the codebase and issue tracker, which could be manipulated by untrusted external users to perform unauthorized operations.
[PROMPT_INJECTION]: The skill has a large surface for indirect prompt injection because it reads and parses raw content from issues and PRs (titles, bodies, comments, and diffs) and uses this data to decide its next actions (SKILL.md, Step 1). Malicious instructions embedded in these fields could hijack the triage process.
Ingestion points: SKILL.md ('อ่าน issue หรือ PR ให้ครบ (เนื้อหา, comment, label, ผู้เขียน, วันที่; ถ้าเป็น PR อ่าน diff ด้วย)')
Boundary markers: None. The skill interprets the untrusted data directly to make recommendations and verify behavior.
Capability inventory: File system access (checkout), command execution (tests), and file writing (issue comments, .out-of-scope/ files).
Sanitization: No sanitization or validation of the untrusted external content is defined.

triage