The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to check out code from external pull requests and run "relevant tests or commands" to verify the diff. Since these PRs are from external contributors, this constitutes execution of code from untrusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue trackers, including issue/PR bodies, comments, and diffs, and uses this information to perform actions like codebase updates and command execution.
Ingestion points: The agent reads the full context of issues and PRs in SKILL.md (Step 1: Gather context).
Boundary markers: There are no instructions for the agent to use delimiters or specific warnings to ignore instructions embedded within the untrusted content.
Capability inventory: The skill has the ability to read and write files (CONTEXT.md, ADRs, .out-of-scope/), run shell commands/tests, and interact with the GitHub API (posting comments, applying labels, closing issues).
Sanitization: No sanitization or validation of external content is described before the agent processes it.
[COMMAND_EXECUTION]: The skill is directed to reproduce bugs by following "the reporter's steps," which often includes executing shell commands provided in an untrusted issue report.
[DYNAMIC_EXECUTION]: The skill performs runtime execution of code (tests and reproduction steps) that is retrieved from external, non-verified sources during the triage process.

triage