The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to "check it out, run the relevant tests or commands" when verifying external pull requests in SKILL.md. This allows for the execution of arbitrary shell commands defined by external contributors.
[REMOTE_CODE_EXECUTION]: By facilitating the checkout and execution of code from external pull requests, the skill creates a vector for remote code execution if a contributor submits malicious scripts disguised as tests or implementation code.
[PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection from untrusted issue and PR data.
Ingestion points: In SKILL.md, the agent is directed to read the full context of issues and PRs, including bodies, comments, and code diffs.
Boundary markers: There are no defined boundary markers or instructions to isolate or ignore embedded commands within the ingested content.
Capability inventory: The skill has the capability to execute shell commands and tests, modify the local filesystem (.out-of-scope/, CONTEXT.md, and ADR files), and post comments to the issue tracker.
Sanitization: The skill lacks any mechanism to sanitize or validate the content of processed issues or PRs before it is used to influence agent logic.
[DATA_EXFILTRATION]: The combined capability of reading the local codebase and executing code from external PRs establishes a potential exfiltration path for source code or sensitive environment variables if the PR code contains malicious network requests.

triage