The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers, specifically issue bodies, comments, and pull request diffs. An attacker could include malicious instructions within these fields to manipulate the agent's logic or prompt it to perform unintended actions.
Ingestion points: Repository issue tracker and external pull requests (SKILL.md).
Boundary markers: The skill requires an AI-generated disclaimer on outgoing comments, but lacks explicit delimiters or "ignore instructions" warnings for incoming external data.
Capability inventory: Codebase exploration, filesystem writing (.out-of-scope/ directory), and shell command execution for bug reproduction and test running.
Sanitization: No mentions of escaping, validation, or filtering of external content before interpolation or execution.
[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to "reproduce it from the reporter's steps" for bugs and "run the relevant tests or commands" for pull requests. This workflow encourages the execution of arbitrary code or shell commands provided by untrusted external users.
[DATA_EXPOSURE]: The skill requires broad access to the project's codebase, including potentially sensitive context, previous triage notes, and the persistent .out-of-scope/ knowledge base to perform its tasks.
[EXTERNAL_DOWNLOADS]: The skill interacts with external issue tracking APIs to query issues, fetch PR diffs, and post triage results externally.

triage