The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates the $ARGUMENTS variable directly into multiple shell commands (e.g., gh pr view $ARGUMENTS, gh pr checks $ARGUMENTS, and gh api ... pulls/$ARGUMENTS/comments) without any shell quoting or validation. This allows a user to execute arbitrary commands by appending shell metacharacters to the PR number.
[PROMPT_INJECTION]: The skill is designed to automatically ingest and "fix" issues based on feedback found in Pull Request comments. Since these comments come from untrusted sources (humans or bots), a malicious actor could post crafted comments containing instructions to trick the agent into performing unauthorized actions.
Ingestion points: GitHub API comments endpoint in SKILL.md.
Boundary markers: None. The agent is instructed to consider all top-level comments without a reply as unaddressed feedback.
Capability inventory: The skill has the ability to modify the local filesystem, perform git commit and git push, execute administrative merges, and run arbitrary repository scripts via pnpm run prep.
Sanitization: No sanitization or safety filtering is applied to the content of the comments before the agent attempts to implement the requested "fixes".
[COMMAND_EXECUTION]: The skill employs the --admin flag when executing gh pr merge. This allows the agent to merge code while bypassing repository branch protection rules, such as required status checks or minimum approval counts. When combined with the potential for indirect prompt injection, this significantly increases the risk of unverified or malicious code being integrated into the main branch.

babysit-pr