The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data from GitHub issue bodies and comments into its decision-making and execution flow.
Ingestion points: SKILL.md (Step 1) instructs the agent to read the full issue body, comments, and reporter information.
Boundary markers: None identified. There are no instructions or delimiters used to separate untrusted reporter content from the agent's core instructions.
Capability inventory: The agent has the capability to execute shell commands ('run tests or commands'), write to the local filesystem ('.out-of-scope/'), and interact with the GitHub API (posting comments and closing issues).
Sanitization: None identified. The skill does not provide any logic for validating or sanitizing reproduction steps provided by external reporters before they are processed by the agent.
[COMMAND_EXECUTION]: The skill contains logic that leads to the execution of system commands derived from external, untrusted input.
Evidence: In SKILL.md, the 'Reproduce (bugs only)' section explicitly directs the agent to 'read the reporter's steps... [and] run tests or commands.' This allows an attacker who can post or comment on an issue to potentially achieve command execution in the agent's environment by providing malicious shell fragments disguised as reproduction steps.

triage