The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes third-party reviews and comments from GitHub PRs as data, which could contain malicious instructions. * Ingestion points: Fetches PR reviews, inline threads, and issue comments using gh pr view and the gh-pr-threads.sh script referenced in SKILL.md. * Boundary markers: Includes an explicit Triage rubric in SKILL.md for PROVENANCE-FLAG that instructs the agent to identify and ignore common injection patterns like 'ignore previous instructions'. * Capability inventory: The skill (via SKILL.md and REFERENCE.md instructions) has permission to modify files, execute shell commands (repository build tools), commit/push changes, and schedule its own wakeups. * Sanitization: Implements logic to triage external input and specifically avoid acting on instructions embedded in review comments, treating them as data to be surfaced to the user instead of instructions to be obeyed.
[COMMAND_EXECUTION]: The skill is designed to verify fixes by executing the repository's own tooling (e.g., npm test, cargo clippy, make) as described in REFERENCE.md. This involves executing code defined within the repository, which may be untrusted if the pull request being processed contains malicious modifications to these tools or their configurations.
[PERSISTENCE]: Utilizes a platform-specific ScheduleWakeup mechanism described in SKILL.md to autonomously continue its operation across sessions until a PR is merged or closed.

babysit-prs