The Agent Skills Directory

[COMMAND_EXECUTION]: The Phase 1 automation for copying the triage table to the clipboard utilizes shell commands that interpolate the full table content directly into an 'echo' statement (e.g., 'echo "{full triage table}" | xclip'). If a pull request title or body contains shell metacharacters, backticks, or subshell expressions, these could be executed by the shell during the copy operation when the agent runs the command.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull requests and interpolates it into an internal sub-agent pipeline, creating a vulnerability to indirect prompt injection.
Ingestion points: Pull request bodies and code diffs are ingested via 'gh pr view' and 'gh pr diff' in Phase 2.
Boundary markers: PR content is labeled but not strictly delimited or accompanied by instructions to ignore embedded commands, allowing malicious content to potentially influence the sub-agent's code review.
Capability inventory: The results are used to generate GitHub comments that the maintainer is encouraged to post, creating a vector for project-wide influence.
Sanitization: No escaping or sanitization of the PR content is performed before it is passed to the sub-agent.
[DATA_EXFILTRATION]: The Phase 4 worktree setup feature processes a '.worktreeinclude' file from the repository to automate the copying of local files. Because the script does not validate the paths provided in this file, a malicious repository could use path traversal sequences (e.g., '../../.ssh/id_rsa') to trick the maintainer into copying sensitive files from outside the repository into the worktree directory, potentially leading to accidental exposure.

pr-triage