The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates untrusted data from external sources into its decision-making process.\n
Ingestion points: As described in SKILL.md, the agent reads the full body, comments, and diffs of issues and pull requests from the project's issue tracker.\n
Boundary markers: The instructions do not provide explicit delimiters or warnings to help the agent distinguish between its own instructions and the content of the issues/PRs it processes.\n
Capability inventory: The agent has the ability to write files to the .out-of-scope/ directory and execute shell commands to verify contributions.\n
Sanitization: There are no instructions for validating or sanitizing the content or code extracted from the issue tracker before processing or execution.\n- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute code provided by untrusted external contributors.\n
Evidence: SKILL.md instructs the agent to "check it out, run the relevant tests or commands" to verify the validity of a bug report or pull request. This creates an execution path for malicious code hidden within the repository's test files or build scripts.

triage