The Agent Skills Directory

[COMMAND_EXECUTION]: The triage process described in SKILL.md explicitly instructs the agent to "run tests or commands" during the bug reproduction phase. This grants the agent the capability to execute shell commands on the local system.- [REMOTE_CODE_EXECUTION]: The skill dictates that the agent should follow the "reporter's steps" found in GitHub issues to reproduce bugs. Since GitHub issues are created by external, untrusted users, this logic allows an attacker to supply arbitrary commands that the agent will execute, leading to unauthorized code execution.- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The skill ingest untrusted data from GitHub issue bodies, comments, and reporter-provided steps as specified in SKILL.md. 2. Boundary markers: There are no instructions for the agent to sanitize the input or ignore commands contained within the issue text. 3. Capability inventory: The agent has the ability to run shell commands, write files to the repository's .out-of-scope/ directory, and post comments back to the issue tracker. 4. Sanitization: No validation or sanitization mechanisms are defined for the reproduction steps before they are passed to a shell for execution.

triage