The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to verify external pull requests by checking out the code and running "relevant tests or commands." This process involves the execution of arbitrary, potentially malicious code provided by third-party contributors, which serves as a significant attack vector.
[COMMAND_EXECUTION]: The workflow requires the agent to execute shell commands to explore the codebase and run verification tasks, providing a high-capability environment that can be abused by untrusted inputs.
[INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection as it routinely ingests and processes untrusted data from an issue tracker.
Ingestion points: SKILL.md directs the agent to read the full body, comments, and diffs of issues and pull requests.
Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from following instructions embedded within the ingested text.
Capability inventory: The agent can explore the filesystem, write to .out-of-scope/, execute shell commands, and post public comments on the issue tracker.
Sanitization: No sanitization or validation of the content fetched from the issue tracker is performed before it is used to influence the agent's behavior.

triage