The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which can be used to influence the agent's behavior.
Ingestion points: The agent is instructed in SKILL.md to read the full context of external issues, comments, and pull request diffs.
Boundary markers: The instructions are absent of requirements for using delimiters or protective prompts to isolate untrusted external content from the agent's primary instructions.
Capability inventory: The agent has the ability to write to the filesystem (.out-of-scope/ directory), post public comments on GitHub, and execute shell commands (SKILL.md).
Sanitization: There are no explicit steps provided to sanitize or filter external input before it is processed or used in decision-making.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to perform actions that involve executing code from external, untrusted sources.
Evidence: In SKILL.md under the verification step (Step 3), the agent is told to "checkout 下来，运行相关测试或命令" (check it out, run relevant tests or commands) for external PRs.
Risk: This creates a direct path for executing malicious code if an external contributor includes harmful scripts within their pull request's tests or build configuration.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of code that is dynamically retrieved and loaded from external pull requests.
Evidence: The workflow in SKILL.md involves pulling external diffs and running the associated code to verify claims made by the contributor.

triage