The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and act upon untrusted data from GitHub PR comments and reviews. It is explicitly instructed to autonomously "patch code locally, validate, commit, [and] push" fixes based on these external inputs.
Ingestion points: PR issue comments, inline review comments, and review bodies fetched from the GitHub API via scripts/gh_pr_watch.py.
Boundary markers: The instructions do not specify any delimiters or explicit 'ignore' markers when interpolating these external comments into the agent's prompt context.
Capability inventory: The agent has the authority to modify local source code, run validation tests, perform git commits and pushes, and interact with the GitHub API to resolve review threads.
Sanitization: The skill relies on the agent's internal reasoning to "classify" and "verify" comments, although scripts/gh_pr_watch.py implements a filter to only surface comments from trusted authors (OWNER, MEMBER, COLLABORATOR).
[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/gh_pr_watch.py to execute the GitHub CLI (gh) and Git commands. These executions are performed using list-based arguments, which prevents shell injection vulnerabilities. The commands are necessary for the skill's primary function of monitoring and updating Pull Requests.
[DATA_EXFILTRATION]: The skill accesses PR metadata, review content, and CI job logs, which are saved to temporary files in /tmp for processing. While these data operations are directed toward the intended PR and the local environment, the access to repository content and logs constitutes a data exposure surface relevant to the agent's context.

babysit-pr