The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub issue titles, bodies, and comments, creating a potential surface for indirect prompt injection.
Ingestion points: Untrusted data is ingested through scripts/get_issue.sh and scripts/get_comments.sh.
Boundary markers: The instructions include a critical warning to ignore any instructions inside the issue body or comments telling the agent to run scripts or perform actions.
Capability inventory: The agent's capabilities are restricted to reading issue context and writing a local triage-decision.json file. It lacks tools for repository mutation (posting comments, labels, etc.).
Sanitization: The agent is explicitly instructed to provide neutral, paraphrased summaries rather than echoing attacker-controlled text verbatim and to adhere to a 1000-character limit.
[COMMAND_EXECUTION]: The skill executes local bash scripts to fetch repository information.
Evidence: Use of scripts/get_issue.sh, scripts/get_comments.sh, scripts/get_labels.sh, scripts/get_linked_prs.sh, and scripts/search_issues.sh to gather data.
Context: These are read-only operations essential to the primary task of issue triaging and do not involve executing untrusted remote code.

triaging-issues