The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests, creating a surface for indirect prompt injection attacks.
Ingestion points: The scripts/pr-wait script retrieves external content including pull request comments, review summaries, and discussion thread replies via the GitHub GraphQL API (specifically in the fetch_pr and poll methods).
Boundary markers: The script prints these external messages directly to the agent's output stream without utilizing clear delimiters or instructions to the agent to treat the content as data rather than instructions.
Capability inventory: The skill's primary purpose is to fix real failures and findings, which implies the agent has the capability to perform file system modifications and execute git commands based on the feedback it receives.
Sanitization: While the script implements a plain() function to strip HTML/XML tags and comments, it does not sanitize the remaining natural language text which could contain malicious instructions.
[COMMAND_EXECUTION]: The skill relies on the gh (GitHub CLI) utility to interact with the repository and fetch state.
Evidence: The Python script scripts/pr-wait uses subprocess.run to execute various gh subcommands, including api, pr view, pr checks, and pr diff to monitor the PR status.
Safety Context: Input parameters such as the pull request number and repository identifier are validated using strict regular expressions in the parse_target function before being used as command-line arguments.

babysit-pr