The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from pull request bodies, comments, and pasted Discord threads, which could contain malicious instructions to influence the agent's verdict or actions.
Ingestion points: Pull request metadata, diffs, comments, and pasted Discord threads as described in the Intake and Discord sections of SKILL.md.
Boundary markers: Absent; untrusted content is processed without explicit delimiters or "ignore embedded instructions" warnings.
Capability inventory: The skill has extensive capabilities including forge write actions (approve, merge, close via gh or glab), git operations (push, rebase, worktree management), and local test execution.
Sanitization: No sanitization or escaping of external content is specified before the content is processed or included in forge communications.
[COMMAND_EXECUTION]: The skill provides numerous shell command templates for git, gh, and glab that incorporate variables like repository names, author handles, and PR numbers derived from external contributions, which could lead to command injection if malicious strings are provided in metadata.
[DYNAMIC_EXECUTION]: Instructions require the agent to run "targeted tests" and "scratch hook probes" on the code within a PR. Because these tests are part of the external contribution, they may contain malicious code that executes in the agent's environment during the triage process.

pr-triage