auto
Warn
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: MEDIUMPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions explicitly direct the agent to bypass human-in-the-loop safety mechanisms. Evidence includes directives to be "chained without manual approval gates", to "treat it as approved and proceed to /do", and to "self-answer with recommended answers instead of waiting on the user". This removes the opportunity for users to review potentially dangerous plans before they are executed.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources which could contain malicious instructions designed to hijack the autonomous workflow.\n
- Ingestion points: Task descriptions from
$ARGUMENTS, conversation history, and external pull request content from GitHub via the--babysitflag.\n - Boundary markers: None provided to distinguish between system instructions and user-supplied data within the autonomous chain.\n
- Capability inventory: The skill chains directly into the
/docommand, which typically performs file modifications and system command execution.\n - Sanitization: No sanitization or validation of the input task text is mentioned, relying instead on internal "self-verification" gates that can be bypassed by the agent.\n- [COMMAND_EXECUTION]: The skill facilitates the automated execution of the
/docommand, which involves system-level operations and modifications, performed without a manual approval step once the chain has started.
Audit Metadata