The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md explicitly direct the agent to execute code provided by external authors. Specifically, under the 'Verify the claim' section, the agent is told: 'For a PR, confirm the diff does what it claims: check it out, run the relevant tests or commands.' This behavior allows for the execution of arbitrary, potentially malicious code contained within an external pull request.
[COMMAND_EXECUTION]: The agent is empowered to run shell commands to verify pull requests and explore the codebase. These commands are executed based on the context of untrusted external pull requests, creating a pathway for command injection or unauthorized system operations.
[INDIRECT_PROMPT_INJECTION]: The skill lacks sufficient safeguards when processing untrusted data from external sources.
Ingestion points: The agent reads issue bodies, comments, and pull request diffs from the project's issue tracker (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions embedded within the issue or PR content.
Capability inventory: The agent can execute shell commands (SKILL.md), write to the .out-of-scope/ directory (OUT-OF-SCOPE.md), and post comments to the issue tracker.
Sanitization: The skill does not mention any sanitization or filtering of the content read from external PRs or issues before processing.
[DATA_EXFILTRATION]: While not directly exfiltrating data to an external server, the skill is instructed to 'explore the codebase' and 'read the full issue or PR'. Combined with the capability to post comments and write files, there is a risk that sensitive information discovered during codebase exploration could be unintentionally exposed in public comments or documentation if triggered by a malicious prompt injection.

triage