The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements dynamic context injection using the ! prefix in the SKILL.md file. This triggers shell command execution (gh issue view) at the moment the skill is loaded, using user-supplied $ARGUMENTS without sanitization, which creates a potential command injection surface.
[REMOTE_CODE_EXECUTION]: The primary function of the skill involves extracting and running arbitrary code provided by GitHub users in issue reports. While Docker is suggested for isolation, the instructions to 'Extract the reproduction code... and Run it' allow for the execution of arbitrary, potentially malicious code from remote sources.
[PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by processing untrusted input from external GitHub issues without defined boundary markers or sanitization logic.
Ingestion points: The issue body and comments fetched from the denoland/deno repository via the gh tool in SKILL.md.
Boundary markers: The instructions lack delimiters or explicit directives to distinguish between triage metadata and potentially malicious instructions embedded in the issue body.
Capability inventory: The agent has broad shell access (Bash), file management (Read, Write, rm, mktemp), and GitHub interaction capabilities (gh).
Sanitization: There is no evidence of filtering or validation for the content retrieved from the GitHub API before it is processed by the agent.

issue-triage