The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md direct the agent to "check it out, run the relevant tests or commands" when triaging pull requests. This permits the execution of arbitrary code provided by external, untrusted contributors.
[COMMAND_EXECUTION]: The agent uses shell commands to browse the codebase, reproduce bugs, and run tests as part of its triage workflow.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from GitHub issues and pull requests.
Ingestion points: Issue/PR bodies, comments, and diffs are read from the issue tracker (SKILL.md).
Boundary markers: There are no delimiters or specific instructions to treat this content as untrusted.
Capability inventory: The agent can execute shell commands, write to files in the repository, and interact with the GitHub API.
Sanitization: The skill lacks any mechanism to sanitize or validate the content of the processed issues.
[DATA_EXFILTRATION]: Malicious code within an external pull request could exfiltrate sensitive information, such as environment variables or codebase secrets, if executed during the verification process.

triage