The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute code from untrusted external pull requests. In SKILL.md (Step 3), the instructions direct the agent to "check out" and "run the relevant tests or commands" from external PR diffs to verify their functionality, which allows for the execution of arbitrary malicious code.
[DYNAMIC_EXECUTION]: The agent is instructed to "reproduce [a bug] from the reporter's steps" in SKILL.md. Bug reports often include code snippets or scripts provided by external users; executing these to verify a claim presents a high risk of dynamic execution of malicious payloads.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow ingests large amounts of untrusted data from external sources while having access to high-impact capabilities.
Ingestion points: SKILL.md defines reading the full content of issues and pull requests, including bodies, comments, and author metadata.
Boundary markers: There are no instructions to use delimiters or to treat the ingested issue/PR content as untrusted data, making the agent vulnerable to instructions hidden within those inputs.
Capability inventory: The skill allows the agent to explore the codebase, execute shell commands, and write to sensitive files (including .out-of-scope/ documentation, GLOSSARY.md, and ADRs).
Sanitization: The skill does not implement or require any validation or sanitization of external content before it is processed or used to modify the project.
[COMMAND_EXECUTION]: The instructions require the agent to run command-line tools for verification and codebase exploration. When these commands are driven by untrusted inputs (like reproduction steps or PR contents), they create a surface for command injection attacks.

triage