The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from external sources, specifically GitHub issue bodies, pull request descriptions, diffs, and comments. This creates a significant surface for indirect prompt injection, where a malicious contributor could embed instructions designed to manipulate the agent's triage decisions, codebase exploration, or verification steps.
Ingestion Points: Issue/PR bodies, comments, and PR diffs are read into context during the 'Gather context' and 'Triage' steps (SKILL.md).
Boundary Markers: The instructions do not specify any delimiters or safety markers to isolate untrusted external content from the agent's core instructions.
Capability Inventory: The agent has the ability to read and write files in the repository, execute shell commands (for testing), and invoke other skills like /zj-grilling and /zj-domain-modeling.
Sanitization: No explicit sanitization or filtering of external input is described before it is processed by the agent.
[COMMAND_EXECUTION]: As part of the pull request triage process, the agent is instructed to 'confirm the diff does what it claims' by running 'relevant tests or commands' (SKILL.md). While this is essential for verification, executing code from external contributors' PRs carries a risk of executing malicious logic within the agent's environment.
[DYNAMIC_EXECUTION]: The skill involves exploring the codebase and potentially running project-specific tools like roadmap_cli.py or the zj-git wrapper (A-ONLY.md). These interactions involve the dynamic discovery and execution of logic based on the repository's state.

zj-triage