The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file (Step 3: Bug reproduction) instructs the agent to 'Try to reproduce the bug: run tests, execute commands... to confirm the reported behavior.' This grants the agent permission to execute arbitrary shell commands based on external, untrusted input.
[REMOTE_CODE_EXECUTION]: Because the commands to be executed are sourced from GitHub issue bodies and comments written by external users, an attacker can achieve Remote Code Execution (RCE) by submitting a bug report containing malicious commands disguised as reproduction steps.
[DATA_EXFILTRATION]: The arbitrary command execution capability can be leveraged to exfiltrate sensitive information from the environment, including GitHub authentication tokens used by the gh tool and other local secrets or configuration files.
[PROMPT_INJECTION]: The skill's workflow is inherently vulnerable to indirect prompt injection as it processes untrusted text from GitHub issues. It lacks necessary safeguards when transitioning from reading external data to performing critical actions.
[PROMPT_INJECTION]: Evidence Chain: 1. Ingestion points: GitHub issue body and all comments (processed in SKILL.md, Step 1). 2. Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings for the agent when interpreting reporter-provided content. 3. Capability inventory: Shell command execution (for reproduction), GitHub CLI access (gh), and file system write access (.out-of-scope/ directory). 4. Sanitization: Absent. The skill does not implement any validation, sandboxing, or sanitization of reproduction commands provided by reporters.

github-triage