The Agent Skills Directory

[COMMAND_EXECUTION]: The script ci-monitor.py implements a run helper function that utilizes subprocess.run(shell=True). Several functions, including find_run, watch_run, and fetch_failed_logs, interpolate the branch and run_id variables directly into shell command strings. Since the branch variable can be provided via the --branch CLI argument, an attacker could supply a branch name containing shell metacharacters (e.g., ;, &&, or backticks) to execute arbitrary commands on the host system.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external CI logs. Ingestion points: The fetch_failed_logs function in ci-monitor.py retrieves the last 3000 characters of output from gh run view --log-failed. Boundary markers: No delimiters or instructions to ignore embedded commands are used when presenting this log data to the agent. Capability inventory: The skill can execute shell commands (via gh, git, and jj) and write to the filesystem (via sentinel files in /tmp). Sanitization: No filtering or escaping is applied to the log content before it is processed by the agent. A malicious actor could commit code that produces specific log output designed to manipulate the agent's behavior during the CI monitoring phase.

ci-monitor