The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute code provided in pull requests during the verification phase. Because pull requests can be submitted by any external contributor, this allows for the execution of arbitrary, potentially malicious commands on the system running the agent.
Evidence: SKILL.md states: "For a PR, confirm the diff does what it claims: check it out, run the relevant tests or commands."
[REMOTE_CODE_EXECUTION]: The instruction to run code from external pull requests constitutes a remote code execution risk. A malicious actor could submit a PR containing harmful scripts designed to be executed when the agent attempts to verify the PR's claims.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources (issue trackers), including issue descriptions, pull request bodies, and user comments. This untrusted data directly influences the agent's logic for writing documentation, posting comments, and executing code.
Ingestion points: Untrusted data enters the context when the agent reads the full issue or PR, including comments and diffs, as described in Step 1 of SKILL.md.
Boundary markers: The instructions do not specify any boundary markers or delimiters to prevent the agent from following instructions embedded within the issue or PR text.
Capability inventory: The agent has significant capabilities, including executing shell commands (SKILL.md Step 3), writing to the local filesystem (updating .out-of-scope/, CONTEXT.md, and ADRs in Step 5), and performing network operations (posting comments back to the issue tracker).
Sanitization: There is no mention of sanitizing or validating the ingested text before it is used to formulate prompts or execute tasks.
[DYNAMIC_EXECUTION]: The skill requires the agent to dynamically identify and execute commands or tests based on the content of a PR diff, leading to the execution of code generated outside the skill's controlled environment.

triage