The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically loads and executes a control adapter based on a name provided in the configuration (control.skill_name). This allows for dynamic loading of code or tools from computed paths at runtime, which can be exploited if the configuration file is modified to point to a malicious skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Slack threads and external tracker issues to automate bug reproduction and fixes.
Ingestion points: Data enters the agent's context from Slack source threads (SOURCE_THREAD_TS) and tracker URLs specified in the triage markers.
Boundary markers: The skill uses specific triage markers (e.g., [benny:bug]) and "triage_identity_user_id" checks to validate the source of instructions, though these do not prevent adversarial data embedded within the bug report.
Capability inventory: The skill has the ability to post to Slack, open GitHub pull requests, drive application UIs via clicks and keystrokes, and potentially execute local tests through the tdd skill.
Sanitization: The skill utilizes an "unslop" utility to clean pull request and Slack text, but relies primarily on model behavior to interpret the unstructured bug report data safely.
[COMMAND_EXECUTION]: The control adapter contract requires the ability to "Bring up" app revisions and "Drive UI" using real actions (clicks, keys, typing). This grants the skill the capability to start and interact with arbitrary software revisions, which could be abused to execute malicious code if the targeted repository revision is compromised.

reproduce-and-fix-issues