The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to verify external pull requests by performing a checkout and running "relevant tests or commands". Because external PRs are untrusted sources, this creates a high-risk vector where malicious code embedded in tests, build scripts, or project configurations could be executed in the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external issue trackers, which serves as a major attack surface for indirect prompt injection.
Ingestion points: The skill reads issue bodies, comments, and pull request diffs from an external tracker (SKILL.md, Step 1: Gather context).
Boundary markers: There are no explicit instructions to use delimiters or treat the ingested data as untrusted text rather than instructions.
Capability inventory: The agent has the capability to execute shell commands (SKILL.md, Step 3), write to the file system (SKILL.md, Step 5), and post comments back to the issue tracker.
Sanitization: The instructions do not specify any validation, escaping, or filtering of the external content before it is processed or used to trigger actions.
[COMMAND_EXECUTION]: The requirement to "run the relevant tests or commands" involves the execution of arbitrary shell commands determined by the project being triaged, which is inherently dangerous when applied to untrusted external contributions.

triage