The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's verification phase for pull requests (PRs) explicitly instructs the agent to "check it out, run the relevant tests or commands." Because PR content is provided by external, untrusted contributors, this allows for the execution of arbitrary, potentially malicious code within the agent's execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from GitHub issues and pull requests (body, comments, and metadata) to drive its internal state machine and generate agent briefs. The lack of sanitization or specific boundary markers for this ingested data creates a vulnerability where an attacker can embed instructions in an issue or PR to manipulate the agent's triage decisions or output.
Ingestion points: Ingests issue/PR bodies and comments from the project issue tracker (referenced in SKILL.md).
Boundary markers: None present for input processing; a simple disclaimer is used for output but does not protect the agent's own context.
Capability inventory: Includes codebase searching, file creation/modification (writing to .out-of-scope/), and shell command execution for verification.
Sanitization: No evidence of filtering or sanitizing external content before it is processed by the model.
[DYNAMIC_EXECUTION]: The skill involves checking out code at runtime and executing tests or commands based on the contents of that code, which constitutes dynamic execution of externally-supplied instructions.

triage