The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute code provided by external, untrusted contributors.
Evidence: In SKILL.md, the "Verify the claim" section (Step 3) directs the agent to "check it out, run the relevant tests or commands" for pull requests. This results in the execution of arbitrary code from external sources before it has been reviewed by a human.
[COMMAND_EXECUTION]: The skill performs command-line operations based on content found in external pull requests.
Evidence: The instruction in SKILL.md to run tests or commands provided in a PR diff constitutes unsafe command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an issue tracker, providing a surface for malicious instructions to influence the agent's behavior.
Ingestion points: The agent is instructed to "Read the full issue or PR (body, comments, labels, author, dates; for a PR, the diff too)" in SKILL.md (Step 1).
Boundary markers: No delimiters or safety instructions are defined to separate untrusted issue content from the agent's core instructions.
Capability inventory: The agent can execute shell commands (SKILL.md Step 3), write files to the repository such as .out-of-scope/*.md and CONTEXT.md (SKILL.md Step 4 and 5), and perform network operations by posting comments to the issue tracker.
Sanitization: There is no evidence of sanitization or validation of the ingested issue/PR content before it is processed or used to generate agent briefs.

triage