The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process untrusted data from an issue tracker's request surface (issue bodies, comments, and pull request descriptions).
Ingestion points: The skill reads the full content of issues and PRs, including body text and comments (referenced in SKILL.md).
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between its system instructions and instructions embedded within the user-provided issue content.
Capability inventory: The agent has the capability to write files (.out-of-scope/ and ADRs), post comments to the issue tracker, and execute shell commands to run tests.
Sanitization: The skill does not mention any sanitization or filtering of external content before processing.
[COMMAND_EXECUTION]: The triage process includes a step to verify pull requests by executing code provided by external contributors, which presents a risk of running malicious scripts in the agent's environment.
Evidence: The instructions in SKILL.md explicitly state: "For a PR, confirm the diff does what it claims — check it out, run the relevant tests or commands."
Risk: This involves the automated execution of arbitrary code from potentially untrusted third parties (external contributors).

triage