babysit-pr

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill mandates autonomously committing and pushing all local/unrecognized changes, running a persistent self-rearming loop, and includes instructions to create repo files and perform admin force-merges — behaviors that deliberately enable unauthorized code changes, repository tampering, and potential supply-chain abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill’s runtime workflow uses gh pr view, gh api .../pulls/$ARGUMENTS/comments, and gh api .../pulls/$ARGUMENTS/reviews to ingest PR review/comment bodies authored by outsiders (other contributors/bots) into the agent’s LLM context for analysis and replying.