The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub issues and Pull Requests to drive high-privilege actions.
Ingestion points: The workflow in SKILL.md involves reading the full body, comments, and diffs of external issues and PRs.
Boundary markers: Absent. There are no instructions or delimiters provided to isolate untrusted data or warn the agent about potential instructions embedded in PR content.
Capability inventory: The skill is instructed to execute shell commands (SKILL.md), write to repository files such as .out-of-scope/*.md, GLOSSARY.md, and Architecture Decision Records (ADRs), and interact with the project issue tracker.
Sanitization: Absent. The skill does not filter or sanitize external content before using it to drive command execution or project file modifications.
[COMMAND_EXECUTION]: The "Verify the claim" section in SKILL.md explicitly instructs the agent to "check out" and "run the relevant tests or commands" from an external PR diff. This allows for the execution of arbitrary shell commands provided by untrusted contributors.
[DYNAMIC_EXECUTION]: The triage process involves evaluating and executing untrusted code (tests and commands) at runtime from PR diffs to verify reproduction steps or implementation success, representing a form of dynamic execution of third-party logic.

triage