The Agent Skills Directory

Shell Command Execution: The skill utilizes the subprocess.run module in scripts/fetch_queue.py to invoke the GitHub CLI (gh). This is a standard approach for fetching repository data. To enhance security, the script includes a _trusted_gh function that attempts to resolve the location of the gh binary from a specific project path, which is a consideration for ensuring the integrity of the tool being run.
Processing of Untrusted Input: The scheduler ingests data from external GitHub issues and pull requests, which may contain malicious instructions (indirect prompt injection). The skill addresses this by implementing a write: off policy for the scheduler and incorporating filtering logic in scripts/fetch_queue.py to identify and skip spam, empty bodies, or template-only submissions.
Dynamic Script Execution: The skill uses runpy.run_path in scripts/fetch_queue.py to load the plan_batch function from scripts/triage_state.py. It also modifies sys.path to import environment-specific utilities. These patterns are used to maintain modularity and integrate with existing project infrastructure.
Indirect Prompt Injection Surface Analysis: Untrusted data enters the agent context through issue bodies fetched via the GitHub API. While the scheduler does not use explicit boundary markers for the data it passes to workers, it performs sanitization through regex-based heuristics. The scheduler's capabilities are restricted to read-only operations, preventing it from being used to perform unauthorized writes based on injected content.
Security Controls: The skill documentation includes an 'ASCII only' constraint and the implementation uses ASCII-specific regex and encoding checks. This serves as a control against certain classes of obfuscation and character-based attacks.

autopilot-issue-triage-scheduler