The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell operations to interact with the local repository and the GitHub API.
Evidence: scripts/fetch_review_context.py and scripts/watch_pr.py execute gh (GitHub CLI) commands to fetch GraphQL data and verify authentication status.
Evidence: scripts/review_round_code.py executes git blame, git rev-parse, and git merge-base to analyze the history of code changes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub which could be used to manipulate the agent's logic.
Ingestion points: scripts/fetch_review_context.py retrieves the pull request title, body, conversation comments, and review thread comments. These are used to determine the "PR's intent" and whether specific findings meet the "fix bar."
Boundary markers: The skill does not implement delimiters or specific instructions to help the agent distinguish between its own instructions and potentially malicious instructions embedded in the PR data it processes.
Capability inventory: The agent has the ability to check out branches, commit changes to the local repository, and post reviews/comments to GitHub. An attacker could potentially use a PR comment to trick the agent into performing unauthorized code changes or approving malicious commits.
Sanitization: There is no evidence of content sanitization or validation performed on the text fetched from GitHub before it is presented to the agent's context.

babysit-pr