The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions explicitly direct the agent to verify external pull requests by checking out the code and running "relevant tests or commands". Because the skill specifically targets external (non-collaborator) pull requests, this pattern constitutes the execution of untrusted code from a remote source.
[COMMAND_EXECUTION]: The instructions require the agent to "run the relevant tests or commands" for PR verification and to "reproduce [a bug] from the reporter's steps." This allows an external party to provide arbitrary commands that the agent is instructed to execute directly in the environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources and use it to drive high-capability actions.
Ingestion points: External pull request diffs and markdown issue files located in the .scratch/ directory (SKILL.md).
Boundary markers: The skill does not define specific delimiters or warnings to prevent the agent from following instructions embedded within the untrusted PR diffs or bug reports.
Capability inventory: The agent is authorized to execute shell commands, check out code diffs, and perform file system writes (updating GLOSSARY.md, ADRs, and triage notes).
Sanitization: There is no mention of sanitizing or validating the content of the pull request or the reproduction steps before they are executed.

triage