The Agent Skills Directory

[COMMAND_EXECUTION]: The triage workflow in SKILL.md (Step 3: Verify the claim) instructs the agent to "run the relevant tests or commands" provided in pull requests. This creates a mechanism for executing arbitrary shell commands defined by external, potentially untrusted contributors.
[REMOTE_CODE_EXECUTION]: By directing the agent to check out and execute code from external pull request diffs, the skill enables a remote code execution vector. A malicious user could submit a pull request containing harmful logic in its tests or build scripts which would be executed during the verification step.
[PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from issue trackers, which presents an attack surface for indirect prompt injection. Ingestion points: Issue bodies, pull request descriptions, and comments are read during the "Gather context" phase in SKILL.md. Boundary markers: No delimiters or safety instructions are specified to prevent the agent from following commands embedded within the ingested text. Capability inventory: The agent possesses the ability to execute shell commands and write to the local file system (e.g., .out-of-scope/ directory). Sanitization: There is no evidence of validation or sanitization of the external content before it is processed or used to inform execution steps.

triage