The Agent Skills Directory

[COMMAND_EXECUTION]: The Step 3: Bug reproduction workflow in SKILL.md explicitly instructs the agent to "execute commands" and "run tests" based on the "reporter's reproduction steps". Since GitHub issue content is untrusted external input, an attacker can submit a malicious issue containing harmful shell commands that the agent will execute while attempting to reproduce the reported bug.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection. It is instructed to "Read the full issue: body, all comments" in Step 1: Gather context and use this information to drive a "grilling session". A malicious actor could embed instructions in an issue comment designed to override the agent's behavior, bypass the triage state machine, or manipulate the agent's codebase exploration.
[DATA_EXFILTRATION]: The skill instructs the agent to "Explore the codebase to build context" and provides capabilities to post comments back to GitHub issues. An attacker could use indirect prompt injection to trick the agent into reading sensitive local files (such as .env, credentials, or private source code) and exfiltrating them by including the content in a triage summary or agent brief posted as a public GitHub comment.
[EXTERNAL_DOWNLOADS]: SKILL.md suggests the installation of @githubnext/github-cli via pnpm dlx. While this is a known tool, its use in an automated context without version pinning can introduce supply chain risks if the package is compromised.

github-triage