The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to reproduce bugs and verify pull requests by executing "relevant tests or commands." This allows the execution of arbitrary commands within the environment, which could be influenced by malicious instructions in the issue or pull request description.\n- [REMOTE_CODE_EXECUTION]: As part of the triage process for pull requests, the agent is instructed to "check it out" and run the code contained in the diff. Since pull requests can be submitted by external, untrusted parties, this process leads to the execution of arbitrary remote code.\n- [DYNAMIC_EXECUTION]: The skill facilitates the execution of external code at runtime during the verification step. By checking out a pull request and running its tests, the agent executes scripts that are dynamically introduced into the environment from untrusted sources.\n- [METADATA_POISONING]: There is a contradiction between the skill's configuration and its instructions. The SKILL.md frontmatter specifies disable-model-invocation: true, yet the instructions explicitly require the agent to call tools such as the Skill tool for "grilling" and "domain-modeling," and to run shell commands for verification. This inconsistency could lead to unexpected behavior or misjudgment of the skill's capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on processing untrusted input from an external issue tracker.\n
Ingestion points: The agent reads the full content of issues and pull requests, including bodies, comments, and file diffs, as described in SKILL.md.\n
Boundary markers: The instructions lack specific guidance on using delimiters or system-level instructions to ignore potential prompt injections embedded within the issue or pull request text.\n
Capability inventory: The agent possesses significant capabilities, including arbitrary command execution (for verification), filesystem writes (updating .out-of-scope/ files and GLOSSARY.md), and network interaction via the GitHub API (commenting on and closing issues).\n
Sanitization: The skill does not define any sanitization or validation routines for the external data before it is processed or used to trigger command execution.

triage