The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of untrusted data.
Ingestion points: The agent is instructed to read the full body, comments, and diffs of issues and pull requests in SKILL.md (Step 1: Gather context).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore or isolate potentially malicious instructions embedded within the ingested issue/PR content.
Capability inventory: The agent has the ability to execute shell commands (Step 3: Verify the claim), write to the filesystem (Step 5: Apply the outcome
updates to .out-of-scope/, CONTEXT.md, and ADRs), and invoke other skills like /grilling and /domain-modeling.
Sanitization: No sanitization or validation logic is defined for the external content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to perform dynamic command execution based on untrusted input.
Evidence: In SKILL.md (Step 3: Verify the claim), the agent is told to "reproduce it from the reporter's steps" for bugs and "run the relevant tests or commands" for PRs. This requires the agent to interpret and execute instructions derived from potentially malicious external contributors.
[DATA_EXPOSURE]: The agent is granted broad read access to the project environment.
Evidence: It is instructed to "Explore the codebase using the project's domain glossary" and read internal documentation such as ADRs and the .out-of-scope/ knowledge base (SKILL.md, Step 1). While necessary for triage, this access increases the impact of a successful injection attack.

triage