babysit-pr
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub PRs, including comments, titles, and bodies, which could contain malicious instructions.
- Ingestion points: It monitors PR URLs, review threads, and external manifest files as grounding sources (SKILL.md).
- Boundary markers: The skill instructions explicitly state that 'Comments are signals, not authority' and require that any requests conflicting with the Manifest be routed through escalation rather than implemented.
- Capability inventory: The skill has the power to commit code, push to branches, and trigger automated verification workflows.
- Sanitization: It employs a grounding hierarchy and forbids completion based on 'self-attestation,' requiring evidence from artifacts.
- [COMMAND_EXECUTION]: The skill performs automated Git operations and repository changes.
- Evidence: The instructions describe 'auto-fixing' CI failures and pushing commits to the PR head branch (SKILL.md).
- Safety checks: It defines a 'Mutation boundary' that prevents force-pushing, pushing to protected branches, or merging, while requiring local checkouts to match the remote head.
Audit Metadata