The Agent Skills Directory

Command Execution: The skill interacts with the GitHub CLI (gh) to retrieve PR metadata, check CI status, and manage workflow runs. These interactions are performed using safe subprocess patterns that avoid shell expansion and are scoped to the specific repository and pull request being monitored.
Indirect Prompt Injection Surface: The agent processes external data, such as pull request comments and CI job logs, which could potentially contain malicious instructions. The skill mitigates this risk through several built-in constraints:
Ingestion Points: Data is fetched from GitHub's API via the gh_pr_watch.py script (e.g., repos/{owner}/{repo}/issues/{pr_number}/comments).
Boundary Markers: The instructions explicitly direct the agent to ignore pending reviews, filter out unrelated bot noise, and only surface feedback from trusted authors (OWNER, MEMBER, COLLABORATOR).
Capability Inventory: Capabilities include committing code, pushing to the PR branch, and rerunning failed CI jobs. These are governed by a 'GitHub State Mutation Policy' that restricts when and how these actions can be performed.
Sanitization: The monitoring script uses structured JSON parsing and list-based command execution to ensure data is handled safely.
Local File Operations: The skill maintains its state in the /tmp directory using machine-readable JSON files. This is used to track seen comments and retry attempts, ensuring the agent operates within its defined limits (e.g., a maximum of 3 flaky retry attempts).

babysit-pr