The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Requests and local repository files, exposing the agent to instructions from external actors.
Ingestion points: The scripts/pr-wait tool fetches and displays comment bodies, review summaries, and thread replies from GitHub. Additionally, SKILL.md instructs the agent to read repository-specific rule files located at .macroscope/check-run-agents/*.md.
Boundary markers: Content retrieved from GitHub is output to the agent's monitor tool without formal delimiters to isolate untrusted text from system instructions.
Capability inventory: The agent has the capability to execute shell commands, manage files, and interact further with the GitHub API, making it a target for instructions embedded in PR content.
Sanitization: The scripts/pr-wait script provides basic sanitization by stripping HTML tags and collapsing whitespace in ingested content to prevent formatting-based injection.
[COMMAND_EXECUTION]: The skill relies on executing the gh command-line tool to perform its operations.
Evidence: scripts/pr-wait uses subprocess.run to call gh api, gh pr view, and gh pr checks. Parameters such as the PR number and repository owner/name are validated against strict regular expressions before being passed to the shell.

babysit-pr