The Agent Skills Directory

[DYNAMIC_EXECUTION]: The triage process for pull requests includes a verification step where the agent is instructed to "check it out, run the relevant tests or commands" to confirm the diff's functionality. This involves executing code provided by external, untrusted contributors, which could lead to arbitrary code execution within the agent's environment if the pull request contains malicious tests or scripts.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process text from external, untrusted sources such as issue descriptions, PR bodies, and comments. These sources can be used to deliver hidden instructions that manipulate the agent's logic, such as forcing specific state transitions or influencing the content of generated briefs.
Ingestion points: The agent gathers context from issue/PR bodies, comments, labels, and diffs as described in Step 1 of the triage process in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or safety prompts to ensure that the agent ignores instructions embedded within the processed issues or PRs.
Capability inventory: The agent has the capability to write files (creating and updating .out-of-scope/*.md files) and perform GitHub actions (labeling issues, posting comments, and closing issues).
Sanitization: The skill lacks explicit instructions for sanitizing or validating external content before it is processed and interpolated into the agent's context or used to make triaging decisions.
[COMMAND_EXECUTION]: The verification of bug reports and pull requests requires the agent to run commands to reproduce issues or verify code changes. This capability, when applied to data from untrusted reporters, presents a risk of command injection or the execution of malicious local commands.

triage