The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Requests, including comments, reviews, and CI logs, which could contain malicious instructions. While the skill includes explicit instructions for the agent to treat this content as untrusted and ignore embedded shell snippets, it has significant capabilities (file writes, repository mutations, and network operations) that could be targeted by such injections.
Ingestion points: Data enters the system via gh pr view and GraphQL queries that fetch PR comments, reviews, and status check logs.
Boundary markers: No explicit delimiters (like XML tags) are used for the ingested data; the skill relies on a general safety instruction in envelope.md and SKILL.md.
Capability inventory: The skill and its delegates have authority to execute git commit, git push, gh pr edit, gh pr close, and gh run rerun. It also performs network operations via the gh API.
Sanitization: The skill relies on delegated sub-skills (ce-resolve-pr-feedback and ce-debug) and the agent's internal reasoning to filter and validate actions based on untrusted input.
[DYNAMIC_EXECUTION]: The bundled script scripts/pr-snapshot uses the ctypes library on Windows to interface with kernel32.dll. It invokes system APIs like OpenProcess, GetProcessTimes, and QueryFullProcessImageNameW to implement a PID-reuse guard, ensuring that it only terminates or communicates with legitimate background watch processes.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to interact with the local filesystem and the GitHub CLI. It executes commands such as git, gh, and its own Python scripts. The scripts include input validation (such as regex-based branch name validation) to prevent basic command injection.

ce-babysit-pr