The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's reproduction step for bugs instructs the agent to "read the reporter's steps" and "run tests or commands." Since these steps are provided by untrusted external users (issue reporters), an attacker could craft a bug report that tricks the agent into executing malicious system commands or damaging scripts under the guise of a reproduction case.
[PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers, including issue bodies and comments. This represents an indirect prompt injection surface where an attacker can embed malicious instructions to influence the agent's classification, recommendations, or writing of local knowledge base files.
Ingestion points: Issue tracker data including issue bodies, comments, labels, and reporter identity as specified in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested issue content.
Capability inventory: The agent has the ability to read codebase files, execute shell commands and tests, post comments to external issue trackers, and create or update local files in the .out-of-scope/ directory.
Sanitization: No sanitization or validation logic is defined for the content extracted from external issue reports before it is processed by the agent.

triage