The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted external data from GitHub issues into its operational logic.
Ingestion points: SKILL.md (Step 1: Gather context) reads the full issue body and all comments. Additionally, Step 3 (Bug reproduction) explicitly instructs the agent to "Read the reporter's reproduction steps".
Boundary markers: There are no instructions to use delimiters or ignore embedded commands within the issue text.
Capability inventory: The agent can execute gh commands to modify repository state (comments, labels, status), write to the local filesystem (the .out-of-scope/ directory), and has a broad mandate to "execute commands" to reproduce bugs. This creates a high-risk surface where an attacker can provide malicious shell commands disguised as reproduction steps.
Sanitization: No sanitization or validation is performed on the ingested content before it is processed.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via the gh and git CLIs. While these are legitimate tools, their use is driven by natural language interpretation of untrusted data, which can be manipulated to execute unintended or malicious operations.

github-triage