The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external GitHub issues, including titles, labels, and bodies. This content is used to determine execution logic and dependencies for the agent. \n
Ingestion points: SKILL.md (Step 1 and 2), references/start.md (Classify section). \n
Boundary markers: The skill does not define specific delimiters or instructions to ignore malicious commands embedded in issue text. \n
Capability inventory: The skill has access to Bash, allowing for shell command execution, and AskUserQuestion for user interaction. \n
Sanitization: No evidence of sanitization or escaping of the issue content before processing. \n- [COMMAND_EXECUTION]: The skill instructs the agent to run grep commands using keywords ('concepts') extracted directly from untrusted issue bodies. If these concepts contain shell metacharacters, it could lead to arbitrary command execution via the Bash tool. \n
Evidence: SKILL.md (Step 2) states: 'grep for the concepts it names (routes, tables, components, message keys) and add the files that define them.' \n- [REMOTE_CODE_EXECUTION]: The skill fetches and merges code from unmerged Pull Request heads (headRefOid) from GitHub into a local environment. \n
Evidence: references/start.md (Merge Order section) contains logic to git fetch origin <headRefOid> and merge them into a scratch worktree. \n- [DYNAMIC_EXECUTION]: After merging unmerged PR code, the skill automatically executes 'quality gates'. These are project-specific build or test scripts that are part of the repository and could be modified by a malicious PR to execute arbitrary code during the batching process. \n
Evidence: references/start.md (Merge Order section) states: 'run the project's quality gates once in $SCRATCH, with the fresh-checkout step and gate parts from Pre-flight'.

forge-batch