babysit-pr
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (GitHub PR comments and reviews) that could be manipulated to influence agent behavior.\n
- Ingestion points: Fetches PR comments, reviews, and inline comments using
gh pr viewandgh apiinSKILL.md.\n - Boundary markers: The PR's stated purpose is defined as the instruction boundary; the skill explicitly directs the agent to "verify every claim against the code" before taking action.\n
- Capability inventory: Possesses filesystem write access, GitHub push permissions via
gh, and the ability to execute repository scripts (lint, tests, etc.).\n - Sanitization: Requires manual verification of claims against the source code and explicitly prohibits changes that expand the PR's original scope.\n- [COMMAND_EXECUTION]: The skill invokes project-specific scripts for linting and testing as part of its automated loop.\n
- The agent is instructed to "run the repo's own checks (typecheck, lint, tests)", which involves executing code residing in the branch being modified, posing an inherent risk if the branch contents are untrusted.
Audit Metadata