The Agent Skills Directory

[SAFE]: The skill implements a robust "Assume-Malicious" posture toward external data. It explicitly instructs the agent to treat fetched issue and PR text as untrusted data and ignore any embedded instructions (Category 8 mitigation).
[SAFE]: Command execution is strictly scoped to the official GitHub CLI (gh) and standard git commands. The skill employs secure practices for shell interaction, such as passing untrusted PR bodies via stdin/files rather than shell-interpolated strings to prevent command injection.
[SAFE]: Write operations are highly controlled. The skill requires Phase 2 merges and Phase 5 issue updates to be presented in a full triage view for explicit user approval before execution. It prevents autonomous merging by disabling model invocation (disable-model-invocation: true).
[SAFE]: Privacy is maintained by keeping priority and size estimates strictly local. The instructions and the recipe.py logic contain multiple explicit prohibitions and technical checks to ensure this data is never posted back to GitHub.
[SAFE]: Subagents spawned for PR reviews are configured as read-only. Their output is saved to local Markdown files and never submitted to GitHub, preventing automated or unauthorized review postings.
[SAFE]: The skill uses the trailofbits vendor context consistently. The assets and organization references align with the author's identity.

github-triage