The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill directs the agent to execute code and scripts provided by external, untrusted contributors as part of the verification process.
Evidence: In SKILL.md under the "Verify the claim" section, the agent is instructed: "For a bug, reproduce it from the reporter's steps. For a PR, confirm the diff does what it claims: check it out, run the relevant tests or commands."
Risk: This instruction establishes a direct path for remote code execution (RCE). A malicious actor could provide harmful shell commands within an issue's "reproduction steps" or include malicious logic in pull request tests that the agent is then directed to execute, potentially compromising the host environment or project data.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from an external issue tracker without implementing boundary markers or sanitization logic.
Ingestion points: According to SKILL.md, the agent is tasked with reading the "full issue or PR (body, comments, labels, author, dates; for a PR, the diff too)."
Boundary markers: The skill does not provide the agent with specific delimiters or instructions to ignore potential commands embedded within the text of the issues or pull requests.
Capability inventory: The agent has the authority to execute subprocess commands ("run relevant tests"), write to the filesystem (modifying .out-of-scope/ files and documentation like CONTEXT.md), and search the entire codebase.
Sanitization: There is no requirement for the agent to validate or sanitize external input before it is used to drive command execution or project documentation updates.

triage