The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded in external data it processes during its operation.
Ingestion points: The skill retrieves untrusted content (comments and reviews) from external PRs using the gh pr view command as described in Step 2 of SKILL.md.
Boundary markers: There are no explicit boundary markers, delimiters, or instructions provided to the agent to treat the ingested comment text as data rather than instructions.
Capability inventory: The skill possesses extensive capabilities, including executing shell commands via the gh and git CLIs, modifying the local file system, and pushing code to remote repositories.
Sanitization: The skill lacks mechanisms to sanitize or validate the content of PR comments before the agent 'acts on feedback' to make code changes or replies.

babysit