The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to verify pull requests by checking out the diff and running the relevant tests or commands. Because pull requests from external contributors are untrusted, an attacker could submit a malicious PR containing harmful scripts or tests that, when executed by the agent for verification, would compromise the execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses issues, pull request bodies, and comments provided by external reporters. These inputs serve as a significant attack surface for indirect prompt injection, where an attacker can embed malicious instructions to override the agent's behavior, manipulate labels, or influence implementation decisions.
Ingestion points: SKILL.md (Triage a specific issue or PR) specifies reading the full issue or PR body, comments, labels, and the diff.
Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to disregard instructions contained within the external issue data.
Capability inventory: The agent can execute shell commands (running tests/reproduction steps), write to the repository (modifying .out-of-scope/ files, CONTEXT.md, and ADRs), and interact with the issue tracker (posting comments and closing issues).
Sanitization: Absent. There is no logic provided to filter or escape the content of the issues being triaged.
[COMMAND_EXECUTION]: The skill directs the agent to reproduce bugs based on a reporter's steps and to execute arbitrary commands for PR verification. This lack of constraint on the commands being run creates a high-risk environment for command injection or execution of malicious payloads supplied by external users.

triage