The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and act upon untrusted data from external PR comments.
Ingestion points: The skill fetches unresolved review threads and reads comment bodies from teammates and automated bots (e.g., Bugbot, CodeRabbit).
Boundary markers: The instructions provide a logical check by telling the agent to 'Validate before changing code' and 'reply with reasoning instead of silently ignoring,' but there are no strict technical boundaries to prevent the agent from obeying instructions embedded within those comments.
Capability inventory: The skill possesses significant capabilities, including modifying the codebase, resolving merge conflicts, and performing git push operations.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the comment content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill uses shell-level commands to manage the repository state.
Evidence: It performs git fetch, branch merging, and git push to synchronize code changes.
[PERSISTENCE_MECHANISMS]: The skill implements a recurring execution model that functions as a persistent background process.
Evidence: It establishes a 'background heartbeat' or uses a /loop primitive to execute every 5 minutes, continuing until the PR is merged or a manual stop is triggered. While this is the intended core functionality, it represents a persistent presence in the execution environment.

melech-babysit