The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses docker run to execute untrusted code from GitHub issues. While this involves executing external instructions, it implements robust defense-in-depth measures:
Uses --runtime=runsc (gVisor) on Linux to isolate the container from the host kernel.
Uses --cap-drop ALL to remove all Linux capabilities.
Uses --security-opt no-new-privileges to prevent privilege escalation within the container.
Explicitly forbids host mounts (-v) to ensure no host filesystem access.
[EXTERNAL_DOWNLOADS]: The skill clones external repositories and installs packages from NPM or local registries inside the sandbox. These operations are restricted to the isolated environment and do not touch the host.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub issues (body, comments) which may contain malicious instructions. The design mitigates this by treating all such data as untrusted and executing it only within the high-isolation sandbox environment. The allowed-tools configuration is properly scoped to the necessary Docker and Git commands required for this purpose.

reproduce-issue