The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, specifically tracker issues and pull request diffs.
Ingestion points: In SKILL.md under "Triaging one issue", the agent is instructed to "Read the full issue — body, comments, labels, author, dates; for a PR, the diff."
Capability inventory: The skill possesses the ability to write to the local filesystem (writing or updating files in the .out-of-scope/ directory), interact with external tracker APIs to post comments and update labels, and invoke sub-skills like root-cause (aliased as /shape).
Boundary markers: While the skill defines a marker for its own generated output (> *This was generated by AI during triage.*), it lacks instructions for using delimiters or "ignore instructions" wrappers when processing the untrusted content of the issues or PRs.
Sanitization: There is no evidence of sanitization, validation, or filtering of the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The verification process instructions in SKILL.md create a direct execution path for potentially malicious code.
Evidence: Step 2 ("Verify the claim") explicitly directs the agent to "reproduce it from the reporter's steps" for bugs and to "run the relevant tests or commands" to confirm pull request functionality.
Risk: This instruction requires the agent to execute code or command sequences provided by untrusted external reporters or PR authors, which could lead to arbitrary command execution on the host system if the agent is not operating in a strictly sandboxed environment.

triage