The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's core workflow (SKILL.md, Step 3) instructs the agent to "confirm the diff does what it claims" by checking out pull requests and running "relevant tests or commands." This facilitates the execution of untrusted code provided by external contributors, which could lead to arbitrary code execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an issue tracker, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Untrusted data enters the context through the "Gather context" step (SKILL.md), which reads the full body, comments, and labels of issues and pull requests.
Boundary markers: The skill uses a disclaimer (> *This was generated by AI during triage.*) for its own output, but it does not implement delimiters or safety instructions to prevent the agent from obeying instructions embedded in the issues or pull requests it reads.
Capability inventory: The skill has the capability to execute shell commands (Step 3), write to the repository (Step 4 and 5: updating GLOSSARY.md, ADRs, and .out-of-scope/ files), and post comments externally.
Sanitization: There is no mention of sanitizing, escaping, or validating the external issue/PR content before it is processed or used to inform command execution.
[COMMAND_EXECUTION]: The skill performs shell operations to verify pull requests and explore the codebase. These operations are susceptible to command injection if malicious data from an issue or PR (such as a branch name or suggested test command) is interpolated into a shell call without proper handling.
[EXTERNAL_DOWNLOADS]: The skill's configuration and source files are adapted from an external repository (github.com/mattpocock/skills.git), as documented in the PROVENANCE.md and UPSTREAM.json files.

triage