The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions require the agent to verify pull requests by checking out the submitted code and executing tests or commands. Because pull requests can be submitted by external and potentially untrusted contributors, this creates a pathway for executing arbitrary malicious code within the agent's environment.
Evidence: SKILL.md section 'Triage a specific issue or PR', step 3: 'For a PR, confirm the diff does what it claims: check it out, run the relevant tests or commands.'
[COMMAND_EXECUTION]: The agent is granted the authority to execute shell commands to explore the codebase and run verification tests, which could be abused if the agent is manipulated.
Evidence: SKILL.md instructions include 'Explore the codebase using the project's domain glossary', 'Run two checks against the codebase', and 'run the relevant tests or commands'.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from an external issue tracker (issue/PR bodies and comments) without explicit sanitization, creating a surface for attackers to embed instructions that could influence the agent's behavior.
Ingestion points: Issue bodies, pull request bodies, comments, and diff contents retrieved from the issue tracker.
Boundary markers: The instructions lack specific requirements for the agent to use delimiters or ignore embedded instructions when reading external content.
Capability inventory: The skill can post comments, apply labels, and close issues on the tracker; write to local project files such as .out-of-scope/*.md and GLOSSARY.md; and execute system commands for testing.
Sanitization: There is no instruction to sanitize or validate the content of the issues or pull requests before the agent acts on them.

triage