The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to manipulate the agent.
Ingestion points: The skill fetches CI failure logs using gh run view --log-failed and retrieves PR review comments via the GitHub API (gh api repos/{owner}/{repo}/pulls/{pr}/comments).
Boundary markers: There are no boundary markers or explicit instructions provided to the agent to treat external content as untrusted data or to ignore embedded instructions.
Capability inventory: The agent has the capability to execute build scripts (npm run build), linters (npm run lint), and tests. Most significantly, it can commit and push changes back to the repository (git push).
Sanitization: The skill lacks sanitization, validation, or filtering of the data retrieved from GitHub before processing it.
[COMMAND_EXECUTION]: The skill relies on executing various shell commands to monitor and fix the repository, including gh CLI for platform interaction and npm/npx for build and linting tasks. This is consistent with the skill's stated purpose but forms the mechanism through which potential injections could be realized.

babysitting-pr