The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull request comments and review threads, which creates a vulnerability where malicious instructions could be embedded in the data being monitored.
Ingestion points: Untrusted data enters the agent context through the gh api graphql commands in SKILL.md that fetch the body of comments and review threads.
Boundary markers: The instructions lack explicit delimiters or warnings for the agent to distinguish between legitimate feedback and potential prompt injection attacks within the PR comments.
Capability inventory: The skill possesses powerful capabilities including the ability to fix code issues in focused commits, push code to the repository, and resolve review threads via GraphQL mutations.
Sanitization: There is no indication of content sanitization or validation of the comment bodies before they are used to guide the agent's code modification and thread resolution workflow.

babysit