The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's instructions in SKILL.md under the 'Verify the claim' section (Step 3 of triage) direct the agent to execute code provided by untrusted external sources. It states that for a bug, the agent should 'reproduce it from the reporter's steps', and for a PR, it should 'run the relevant tests or commands'. This creates a direct pathway for executing arbitrary malicious code submitted by any user who can open an issue or PR.
[COMMAND_EXECUTION]: By instructing the agent to run 'relevant tests or commands' from pull requests to confirm their behavior, the skill facilitates the execution of arbitrary shell commands. If the execution environment is not strictly sandboxed, this allows for system compromise or unauthorized actions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the issue tracker and pull requests to influence its decision-making and output generation.
Ingestion points: The agent reads 'full issue or PR (body, comments, labels, author, dates; for a PR, the diff too)' as specified in the 'Gather context' step of SKILL.md.
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the ingested issue/PR content.
Capability inventory: The skill has the capability to read/write files in the repository (specifically in .out-of-scope/), post comments to the issue tracker, and execute shell commands.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from external contributors before it is used in prompts or execution steps.

triage