The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from an issue tracker, which is a potential surface for indirect prompt injection.\n- Ingestion points: The agent reads the full content of issues and pull requests, including bodies, comments, and code diffs, as specified in SKILL.md.\n- Boundary markers: The instructions do not define delimiters or specific markers to separate untrusted issue content from the agent's internal logic, increasing the risk of the agent following instructions embedded in issue comments.\n- Capability inventory: The agent has significant capabilities including executing shell commands to verify PRs, writing to the filesystem (specifically the .out-of-scope/ directory), and interacting with the external issue tracker to post comments and update labels.\n- Sanitization: There is no evidence of sanitization or filtering of the ingested content before it is processed or used in decision-making.\n- [REMOTE_CODE_EXECUTION]: The skill explicitly directs the agent to execute code originating from external, untrusted sources.\n- In SKILL.md, under the 'Verify the claim' step, the agent is instructed to 'check it out, run the relevant tests or commands' for pull requests. This behavior allows a malicious contributor to gain execution on the agent's host by including harmful code in a PR's test suite or build scripts.\n- [COMMAND_EXECUTION]: The triage process involves running shell commands to validate reported bugs and pull request functionality.\n- The agent is prompted to reproduce bugs and execute PR code locally, which constitutes command execution on untrusted input.

triage