The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from GitHub Pull Requests, which could contain malicious instructions designed to subvert the agent's behavior.
Ingestion points: The skill reads Pull Request comments, review threads, titles, and bodies to ground its actions (SKILL.md).
Boundary markers: It explicitly defines a hierarchy of intent where a pre-defined "Manifest" or PR metadata is treated as a stronger authority than comments. It instructs the agent not to silently implement requests from comments that conflict with these sources (SKILL.md).
Capability inventory: The skill has the ability to perform file writes (logs), execute git commands (auto-fixes, pushes), and invoke other development skills (SKILL.md).
Sanitization: Malicious or conflicting instructions found in comments are intended to be routed through an escalation or manifest amendment process rather than direct execution (SKILL.md).
[COMMAND_EXECUTION]: The skill is designed to perform automated code mutations and repository operations.
Evidence: It performs "Auto-fix and push" operations, CI retriggers, and description synchronizations (SKILL.md).
Mitigation: The skill contains safety constraints such as requiring a trusted and writable head branch, checking that the local SHA matches the remote, and explicitly forbidding force-pushes, merges, or pushes to base branches (SKILL.md).
[DATA_EXFILTRATION]: The skill accesses the local file system to maintain an operational journal.
Evidence: It reads and writes persistent logs to ~/.manifest-dev/logs/ to track "dead-end memory" (reverted fixes and rejected approaches) across sessions (SKILL.md).
Context: While this is a tool-specific log directory, the use of the user's home directory ($HOME or %USERPROFILE%) requires broad file system access permissions (SKILL.md).

babysit-pr