The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs extensive automated command execution using the gh (GitHub) and git CLI tools. Authorized actions include creating commits, pushing branches, rerunning failed Actions, and merging managed stacks using gh stack merge. These operations are well-defined within the skill's primary purpose of PR management.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes untrusted data from external sources.
Ingestion points: Data is ingested via gh pr view (pull request comments, review bodies) and CI log tails fetched from GitHub Actions runs.
Boundary markers: The instructions include an explicit "Security" section and a "Core Principle" warning the agent to treat comment and log text as untrusted input and never execute shell snippets or scripts found within them.
Capability inventory: The skill has the capability to write to the local filesystem (in /tmp), perform Git operations (commit, push), and call GitHub APIs via the gh tool.
Sanitization: The skill instructs the agent to decide on fixes independently by reading the actual code, rather than relying on suggestions in the untrusted input.
[DATA_EXPOSURE]: The skill manages internal state in a local directory under /tmp. It implements security best practices to protect this data, including the use of restricted permissions (umask 077 and chmod 700) to ensure state files are only accessible by the current user.
[PERSISTENCE_MECHANISMS]: To achieve its "babysitting" goal, the skill provides instructions for setting up durable monitoring loops using system-level schedulers like cron or harness-specific tools (e.g., Grok's durable scheduler). This is intended behavior for the long-running watch task and does not involve malicious persistence.

ce-babysit-pr