The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as issue trackers, bug reports, and pull requests to drive its triage logic.
Ingestion points: SKILL.md instructs the agent to read the full issue body, comments, and pull request diffs in the "Gather context" step.
Boundary markers: The skill does not provide instructions to use delimiters or "ignore embedded instructions" warnings when processing these external data sources.
Capability inventory: The agent has the capability to search the codebase, write files to the filesystem (e.g., in .out-of-scope/), and execute shell commands.
Sanitization: There are no requirements to sanitize or validate the external content before the agent acts upon it.
[COMMAND_EXECUTION]: The "Verify the claim" workflow in SKILL.md explicitly directs the agent to "reproduce it [the bug] from the reporter's steps" and "run the relevant tests or commands" found in a pull request diff. This leads to the execution of arbitrary instructions or code provided by untrusted external actors, which could be used to compromise the environment where the agent is running.

triage