The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its primary data ingestion points.
Ingestion points: The skill reads full issue and pull request context (body, comments, author) in SKILL.md (Step 1: Gather context).
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded commands within the ingested issue data.
Capability inventory: The skill can execute subprocesses (run relevant tests or commands), write to files (.out-of-scope/*.md), and perform network operations via issue tracker APIs.
Sanitization: There is no evidence of sanitization, escaping, or validation of the external content before it is processed or used to influence codebase exploration.
[COMMAND_EXECUTION]: The skill instructions require the agent to execute code from external sources during verification.
Evidence: In SKILL.md (Step 3: Verify the claim), the agent is instructed to "check it out, run the relevant tests or commands" for external Pull Requests. This involves executing arbitrary code provided by untrusted contributors, which could lead to unauthorized system access if the execution environment is not strictly sandboxed.
[DATA_EXFILTRATION]: The skill possesses combined read and network capabilities.
Evidence: The skill explores the full codebase and reads issue metadata while maintaining an active connection to an issue tracker. While no malicious exfiltration logic was detected, the presence of these capabilities allows for the potential collection and transmission of project data.

triage