The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue and PR bodies, comments, and diffs (Step 1 in SKILL.md). This external content is used to inform agent actions without specified boundary markers or sanitization protocols to prevent the agent from following instructions embedded in the triage items.
Ingestion points: SKILL.md (Step 1) reads issue/PR body, comments, and labels.
Boundary markers: Not present; the agent is instructed to 'Read the full issue or PR' without delimiters.
Capability inventory: The agent can write comments, apply labels, close issues, write markdown files to the .out-of-scope/ directory, and execute shell commands/tests.
Sanitization: Not present; the skill does not define rules for filtering or escaping input from the issue tracker.
[COMMAND_EXECUTION]: The triage workflow includes a verification step (Step 3 in SKILL.md) that requires the agent to 'check it out, run the relevant tests or commands' from a pull request diff. This involves executing code provided by external, potentially untrusted contributors.
[DYNAMIC_EXECUTION]: The instruction to run tests and commands provided within an external pull request constitutes dynamic execution of untrusted source code as part of the triage verification process.
[REMOTE_CODE_EXECUTION]: The skill's verification process involves checking out and running code from external contributors (pull requests), which is functionally equivalent to downloading and executing remote scripts from untrusted sources.

triage