The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external pull request comments and review text to drive its workflow, creating an indirect prompt injection surface.
Ingestion points: The scripts/pr_babysit.sh script fetches untrusted data from GitHub PR comments and reviews using gh api calls in functions such as state_json, review_threads_json, and top_level_reviews_json.
Boundary markers: The instructions do not define explicit boundary markers or directives for the agent to ignore instructions that might be embedded within user-submitted comments or review bodies.
Capability inventory: The agent is authorized to perform write actions including git push and gh pr merge, and can potentially delete branches, providing an exploit path if the agent follows malicious instructions in a comment.
Sanitization: There is no sanitization of the fetched text; although review_threads_json truncates bodies to 300 characters, this does not filter out command-like patterns.
[COMMAND_EXECUTION]: The skill executes a local shell script scripts/pr_babysit.sh which uses the GitHub CLI (gh) and jq for data processing. This is standard behavior for the skill's purpose and uses secure variable handling within the script.

babysitting-prs