catalog-babysitter-users
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from GitHub Search and API results which could contain malicious instructions designed to influence the agent's behavior when generating the catalog or user summary.
- Ingestion points: Repository descriptions, topics, and file paths are retrieved via
gh search codeandgh apiin theSKILL.mdprocedure. - Boundary markers: Metadata is structured into a markdown table in
docs/repo-with-babysitter-processes.md, but no specific delimiters or 'ignore' instructions are used to separate this external content from the agent's instructions. - Capability inventory: The skill has the capability to write to the local filesystem and execute shell commands (
gh). - Sanitization: There is no explicit sanitization or validation of the retrieved repository metadata (such as descriptions) before it is interpolated into the catalog file or the final user summary.
- [COMMAND_EXECUTION]: The skill uses the
ghcommand-line tool to perform code searches and API calls against GitHub. These commands are used for the stated purpose of finding and enriching repository data from a well-known service.
Audit Metadata