The Agent Skills Directory

[COMMAND_EXECUTION]: The verification workflow for pull requests (PRs) explicitly instructs the agent to "check it out, run the relevant tests or commands." Executing arbitrary tests or scripts provided within a diff by an external contributor is a significant command execution vector.
[REMOTE_CODE_EXECUTION]: The skill facilitates remote code execution by checking out and running code from external, untrusted pull requests as part of its standard operating procedure for verification.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from issue trackers which could be used to manipulate the agent's logic or trigger unauthorized actions.
Ingestion points: The agent reads issue bodies, pull request descriptions, comments, and diff content from the external issue tracker as described in the "Gather context" and "Verify the claim" sections of SKILL.md.
Boundary markers: The instructions lack explicit boundary markers or delimiters (such as XML tags or clear "ignore instructions within data" rules) to prevent the agent from interpreting data as instructions.
Capability inventory: The agent has the capability to write to the repository's filesystem (creating and updating files in the .out-of-scope/ directory), execute shell commands/tests, and post comments back to the public issue tracker.
Sanitization: There are no requirements or mechanisms mentioned for sanitizing, filtering, or validating the content retrieved from the issue tracker before it is processed by the model.

triage