The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a significant indirect prompt injection surface as it is designed to autonomously read and act upon untrusted external data.
Ingestion points: The agent reads the PR body, comments from reviewers, and full CI failure logs using commands like gh pr view, bun $COMMENTS list, and gh run view --log-failed.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard potential instructions embedded within the PR comments or log outputs.
Capability inventory: The agent has broad capabilities to modify the repository, including git push (with force), git rebase, and various gh commands to manage reviews and merge PRs.
Sanitization: While CLI arguments are quoted in scripts, the logic for "fixing" CI failures relies on the agent's interpretation of log content, which could be manipulated by an attacker to trigger unintended actions.
[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands to interact with the local environment and the GitHub API.
The pr-state.ts script uses Bun's $ shell execution and Bun.spawnSync to manage processes and execute gh and git commands.
Arguments for these commands, such as branch names and commit OIDs, are derived from external repository state, though the scripts include basic quoting logic to mitigate simple injection.

babysit-pr