babysit-pr
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from pull request threads and reviews which are external, untrusted sources. This creates a surface for indirect prompt injection where malicious PR comments could influence the agent's behavior during its autonomous fixing loop.\n
- Ingestion points: Pull request thread bodies and review summaries fetched via the
scripts/threads.shscript from GitHub or GitLab.\n - Boundary markers: The skill uses metadata markers like
<!-- debate-review:... -->to identify specific bot comments, but it lacks robust isolation or escaping for general review content which is parsed and followed by the agent.\n - Capability inventory: The skill can perform repository writes via
git push, interact with forge APIs (GitHub/GitLab) to resolve threads and post replies, and execute local scripts as well as repository-defined build/test gates.\n - Sanitization: No explicit sanitization or validation of the external review content is performed before the agent uses it to decide on and implement code fixes.\n- [COMMAND_EXECUTION]: The skill executes various system tools and scripts to manage the PR lifecycle.\n
- Evidence: Execution of
scripts/threads.shto harvest PR data and usage ofgh apiandglab apifor pull request interactions.\n - Evidence: The skill instructs the agent to run the repository's own test suite (the repo's own gate) and external skill scripts such as
debate-review/scripts/review-pr.mjs.\n - Evidence: The bash harvesting script uses standard command-line utilities (
git,sed,jq) to process forge metadata and git origin URLs.
Audit Metadata