The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request comments, review bodies, and Actions logs. This occurs through commands like gh pr view, gh pr checks, and the pr-wait script. There is a risk that malicious actors could include instructions in PR descriptions or comments to subvert the agent's logic.\n
Ingestion points: External data is read in references/babysit.md, references/ci.md, references/merge.md, references/modernize.md, and references/pr.md using the GitHub CLI and the pr-wait script.\n
Boundary markers: The skill includes strong, repetitive guardrail instructions across multiple files telling the agent to treat PR metadata, logs, and comments as untrusted text and to never follow instructions embedded in them.\n
Capability inventory: The agent has significant capabilities including executing git commands (commit, push, worktree management), merging pull requests, and running build/test tools like bun.\n
Sanitization: The skill relies on instructional boundaries rather than technical sanitization of the ingested data.\n- [COMMAND_EXECUTION]: The skill executes various system commands including git, gh, jq, bun, and lsof. This is necessary for the skill's operation as a git workflow manager. The use of these tools is restricted by the skill's allowed-tools configuration.

git