The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to verify pull requests by checking out the code and running "relevant tests or commands". Because the skill is designed to handle external pull requests from untrusted contributors, this creates a direct path for an attacker to execute arbitrary code within the agent's environment by submitting a malicious PR.
Evidence: SKILL.md contains the instruction: "For a PR, confirm the diff does what it claims — check it out, run the relevant tests or commands."
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from an issue tracker (issue bodies, PR descriptions, and comments) and uses it to drive complex workflows.
Ingestion points: SKILL.md (Step 1: Gather context) mentions reading the full issue or PR, including bodies and comments.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested data.
Capability inventory: The agent has the capability to write to the filesystem (updating the .out-of-scope/ knowledge base), execute shell commands (running tests for verification), and post comments externally.
Sanitization: There is no evidence of sanitization or validation of the external content before it is processed.
[COMMAND_EXECUTION]: The skill performs active exploration of the codebase, including redundancy searches and running commands to verify claims, which involves executing tools across the project directory based on the context of untrusted issue/PR descriptions.

triage