The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and act upon untrusted content from external GitHub resources.
Ingestion points: The agent fetches data from inline threads, review bodies, issue comments, and repository instructions (SKILL.md, Section: Loop).
Boundary markers: Absent. There are no instructions to use delimiters or to disregard natural language instructions embedded within the fetched external data.
Capability inventory: The agent can modify local source code, execute arbitrary shell commands for "relevant checks," and perform remote write operations via the ship tool.
Sanitization: Absent. The instructions do not mandate any validation or sanitization of strings retrieved from the PR before they are processed by the LLM to generate code changes.
[COMMAND_EXECUTION]: The skill directs the agent to run "relevant checks" and utilize a ship tool to commit and push changes. This granting of shell execution and repository write access, while necessary for the skill's purpose, increases the impact if the agent is successfully manipulated via the injection surfaces identified above.

babysit-pr