The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to manipulate the agent's workflow.
Ingestion points: In the 'Launch' phase, the skill instructs a researcher agent to 'read the issue with its comments' and related code. Issue descriptions and comments are attacker-controllable external data.
Boundary markers: The instructions lack explicit boundary markers or delimiters (e.g., XML tags) to isolate the untrusted issue content from the agent's core instructions.
Capability inventory: The skill grants the agent significant capabilities, including performing git commits, pushing code to remote repositories, and merging pull requests (via the referenced babysit-pr skill).
Sanitization: There are no documented steps for sanitizing, filtering, or validating the content retrieved from issues and comments before it is processed by the model.

afk