define
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources to ground its planning manifests, creating a potential attack surface.
- Ingestion points: In
references/BABYSIT_MODE.md, the skill is instructed to read PR titles, descriptions, commit messages, diffs, and review comments to seed the manifest's intent and acceptance criteria. - Boundary markers: The instructions do not define specific delimiters or escaping mechanisms for the external text when it is incorporated into the manifest file.
- Capability inventory: The manifest produced by this skill is used to drive the
/doexecutor, which possesses significant capabilities including file system modification, command execution (via project-specific gates liketestorlint), and the activation of other analysis skills. - Sanitization: The skill contains proactive mitigation in
tasks/PR_LIFECYCLE.md, which defines an 'Untrusted inbox' policy. This policy explicitly forbids the agent from carrying instructions, commands, or executable content from PR comments into code or configurations.
Audit Metadata