The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external contributors via an issue tracker, which introduces a surface for prompt injection attacks.
Ingestion points: The skill reads the full content of issues and pull requests, including bodies, comments, and contributor metadata (as described in SKILL.md).
Boundary markers: There are no instructions for the agent to use delimiters or to treat specific sections of the ingested data as untrusted, increasing the risk that the agent may follow instructions embedded within the data.
Capability inventory: The agent has the authority to run reproduction steps, execute tests, modify the repository filesystem (specifically the .out-of-scope/ directory), and post public comments.
Sanitization: The instructions do not mention any sanitization, filtering, or validation steps for the external data before it is processed.
[COMMAND_EXECUTION]: The workflow involves the execution of code provided by external contributors, which could lead to unauthorized command execution.
Evidence: In SKILL.md, the 'Verify the claim' section explicitly directs the agent to 'check it out, run the relevant tests or commands' when triaging pull requests. This requires the agent to execute code that has not yet been vetted by a human, posing a risk if the pull request contains malicious scripts or test configurations.

triage