The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to check out and run tests or commands from external pull requests to verify them. Since pull request content is provided by external users, this allows for the execution of arbitrary code within the agent's environment. Evidence: SKILL.md Step 3: 'For a PR, confirm the diff does what it claims: check it out, run the relevant tests or commands.'
[COMMAND_EXECUTION]: The skill performs shell commands to verify PRs and interact with the codebase, which are susceptible to injection if the PR content contains malicious command strings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external issue trackers and pull requests which may contain malicious instructions targeting the agent. 1. Ingestion points: SKILL.md (Step 1: Gather context) mentions reading the full issue or PR body, comments, and diffs. 2. Capability inventory: The skill can run shell commands, write to the filesystem ('.out-of-scope/' directory), and post comments to the issue tracker. 3. Boundary markers: Absent. No specific delimiters or instructions are provided to the agent to treat external content as data only. 4. Sanitization: Absent. The instructions do not specify any validation or filtering of the ingested content.

triage