The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to "check it out, run the relevant tests or commands" when verifying external pull requests. This behavior involves executing code provided by untrusted external contributors within the agent's execution environment, which could lead to malicious code execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue tracker comments and PR bodies to gather context and recommendations. This creates an attack surface where a malicious user could provide instructions to the agent through these external inputs.
Ingestion points: Pull request diffs, issue bodies, and reporter comments are read as context in SKILL.md.
Boundary markers: While the skill uses a disclaimer for its output, it lacks boundary markers or "ignore instructions" warnings for the external content it ingests.
Capability inventory: The agent has the ability to execute shell commands (tests), write to the repository (GLOSSARY.md, ADRs, and the .out-of-scope/ directory), and modify issue tracker state (closing issues and posting comments).
Sanitization: There are no documented procedures for sanitizing or escaping the external content before it influences the agent's logic or file-writing operations.
[COMMAND_EXECUTION]: The verification step for bugs and PRs requires the agent to run arbitrary tests or commands specified by the diff or reporter. This allows for high-risk command execution if the input is not strictly controlled or sandboxed.

triage