The Agent Skills Directory

[PROMPT_INJECTION]: The instructions include directives that reduce human oversight by bypassing confirmation steps for sensitive actions. Specifically, the skill commands the agent to 'merge the PR immediately' and explicitly instructs 'Do NOT: Wait for user confirmation'. While this supports autonomous workflows, it overrides standard safety checkpoints for code deployment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources that may be controlled by an attacker who can influence CI output.
Ingestion points: The agent reads data from gh pr checks, gh pr view, and gh run view --log-failed, which includes logs from failed workflows or tests.
Boundary markers: The instructions lack clear delimiters or warnings to treat external log data as untrusted content, increasing the risk that the agent might follow instructions embedded within a failing test log.
Capability inventory: The skill has significant capabilities, including the ability to commit code changes (git push), execute build/test scripts (pnpm), and merge code into the main branch (gh pr merge).
Sanitization: There is no evidence of filtering or sanitizing log data before it is processed by the agent's diagnostic logic.
[COMMAND_EXECUTION]: The skill frequently uses shell commands to manage the development lifecycle, including gh, git, and pnpm. The combination of these powerful tools with instructions to bypass human review for merges increases the potential impact of any instructions injected through CI logs.

ci-monitoring