The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly suppress user oversight and confirmation steps. It states: "the entire workflow should be without any user interaction or breakpoints in the run" and "do not let the user select which issues to work on -- just process all open a5c-assigned issues sequentially." These patterns override the agent's typical safety protocols for human-in-the-loop verification.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8). It ingests untrusted data from an external source and uses it to drive agent actions.
Ingestion points: Fetches issue titles, labels, and metadata via gh issue list --repo a5c-ai/babysitter.
Boundary markers: None. The issue content is passed directly to subsequent tasks without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill invokes /babysitter:yolo (delegating task execution), creates git branches, pushes commits, and creates pull requests.
Sanitization: No evidence of sanitization or validation of the fetched issue content before it is processed by the agent or delegated skills.
[COMMAND_EXECUTION]: The skill executes shell commands using the gh CLI to interface with GitHub. While these are legitimate vendor-related operations for the repository a5c-ai/babysitter, they represent the execution of local binaries with network-connected capabilities.

babysit-babysitter-issues