The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers and pull requests, which can contain embedded malicious instructions intended to manipulate the agent's behavior. • Ingestion points: The skill reads issue descriptions, contributor comments, and pull request code diffs as specified in the 'Collect context' section of SKILL.md. • Boundary markers: While the skill adds a disclaimer to its own responses, it lacks instructions to treat ingested data as untrusted or to ignore instructions embedded within the issues or PRs. • Capability inventory: The agent is authorized to execute shell commands to reproduce bugs and verify PRs, and has permission to write to project files such as CONTEXT.md, ADRs, and the .out-of-scope/ directory. • Sanitization: The skill does not mandate sanitizing or validating reporter-supplied reproduction steps or PR code before execution.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands and test suites that are derived from untrusted external input. • Evidence: Step 3 of the triage process in SKILL.md ('Verify report content') instructs the agent to 'reproduce according to the reporter's steps' for bugs and 'run relevant tests or commands' to verify pull request diffs. This provides a direct path for an attacker to achieve code execution on the agent's environment by providing malicious reproduction steps or test code.

triage