The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub Check logs and descriptions which could contain malicious instructions designed to influence the agent.
Ingestion points: scripts/fetch_failing_checks.py retrieves PR and check-run data from the GitHub API.
Boundary markers: Absent. The skill does not employ boundary markers or specific instructions to treat log content as data only, potentially allowing instructions in logs to influence the agent's diagnosis.
Capability inventory: The agent has the capability to write files, modify source code (to 'apply fixes'), and execute shell commands via scripts/discover_and_verify.py.
Sanitization: Data from check logs and summaries is used directly to determine 'likely causes' and 'proposed fixes' without validation for injection patterns.
[COMMAND_EXECUTION]: The tool discover_and_verify dynamically identifies and runs shell commands based on configuration files found in the repository.
Evidence: scripts/discover_and_verify.py uses subprocess.run to execute commands found in package.json, pyproject.toml, or Makefile. If these repository files are modified by an attacker (e.g., in a malicious PR), they could lead to arbitrary command execution on the agent's environment during verification.
[PROMPT_INJECTION]: The skill's instructions mandate autonomous behavior that bypasses standard user confirmation for code modifications.
Evidence: SKILL.md explicitly states: 'Run this skill automatically... Do not wait for the user to mention CI or ask you to fix failures.' and 'Always apply fixes when the diagnosis identifies actionable failures (default — do not ask)'. This behavior reduces user oversight during automated code changes.

heyeddi-ci-fails