The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Step 3 of the triage process explicitly directs the agent to 'check out' external pull requests and 'run the relevant tests or commands' to verify the claims. This instruction leads to the execution of code provided by untrusted external contributors within the agent's runtime environment, a high-risk vector for arbitrary code execution.
[COMMAND_EXECUTION]: The skill performs shell-based operations to search the codebase for redundant logic, explore domain concepts, and reproduce bugs. It also references an external setup command, '/setup-matt-pocock-skills', which involves executing platform-specific logic.
[EXTERNAL_DOWNLOADS]: The workflow requires fetching external code and metadata from an issue tracker (GitHub) to facilitate the triage and verification steps.
[DATA_EXFILTRATION]: The skill is granted extensive read access to the project's codebase, documentation (ADRs), and issue history. When combined with the capability to execute external code from pull requests, this creates a potential path for sensitive project data or credentials to be accessed and exfiltrated.
[PROMPT_INJECTION]: The skill ingests untrusted data from issue tracker comments, bodies, and pull request diffs. These inputs are used directly to 'gather context' and influence 'grilling' sessions without sanitization or boundary delimiters, leaving the agent vulnerable to indirect prompt injection attacks.
Ingestion points: External issue tracker bodies, comments, and PR diffs (referenced in SKILL.md).
Boundary markers: No specific delimiters or 'ignore' instructions are provided to separate untrusted data from system instructions.
Capability inventory: The agent can execute shell commands (Step 1, Step 3) and modify project files (Step 4, Step 5).
Sanitization: There are no requirements for validating, escaping, or filtering the external content before it is processed by the AI.

triage