The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from sources like GitHub issues and pull requests, which could contain malicious instructions designed to influence agent behavior.
Ingestion points: External items are retrieved via read-only tools or the gh CLI as described in the 'Interpret and resolve the watch' section of SKILL.md.
Boundary markers: The skill explicitly instructs the agent to treat source results and item content as data, separate from the human-authorized common prompt. It specifically forbids copying coordinator context (like authorization or skill paths) into individual item prompts.
Capability inventory: The skill utilizes create_thread to spawn per-item worktree chats, send_message_to_thread for communication, and automation_update to manage its heartbeat.
Sanitization: The skill employs logical isolation by dispatching each item into a dedicated chat with a minimal prompt containing only the item and the common prompt, effectively preventing data from escalating into instructions for the coordinator.
[COMMAND_EXECUTION]: The skill uses the gh (GitHub CLI) for repository discovery and fetching issues or pull requests. This is a legitimate use of the tool for its primary purpose of source monitoring and does not involve arbitrary command injection.

bulk-watch