The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub Pull Requests, including code diffs and CI logs. This content could potentially contain malicious instructions or specially crafted failure logs designed to mislead the agent's diagnostic logic or influence the code it generates for automatic fixes.
Ingestion points: Pull Request diffs, CI job logs, and files from the target repository accessed via git and gh tools.
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating external PR content into the agent's context.
Capability inventory: The agent has the ability to write files, git commit, git push to remote repositories, and trigger GitHub Action reruns via gh run rerun.
Sanitization: Absent. There is no mention of sanitizing or escaping the diffs or logs before they are analyzed for diagnosis.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with the repository and GitHub's infrastructure.
Evidence: Explicit instructions to use gh run rerun <RUN_ID> --failed --repo <OWNER/REPO> and various git operations including git status, git worktree, git commit, and git push.
[DYNAMIC_EXECUTION]: The skill is designed to perform 'local validation' of proposed fixes, which involves executing code or scripts defined within the repository.
Evidence: The instruction to 'Run the smallest meaningful local validation' and 'reproduce the specific hook/check' implies the agent will execute linting tools or test runners that may be configured by untrusted code in a PR.

babysit-pr-to-pass-ci