babysit-prs
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill manages untrusted content from GitHub Pull Request metadata and comments which could contain adversarial instructions. This risk is mitigated through a multi-layered defense strategy.
- Ingestion points: Data is fetched from the GitHub API in scripts/pr_queue_snapshot.py and scripts/babysit_gh.py.
- Boundary markers: reference/orchestration.md defines strict BEGIN/END QUOTED PR DATA delimiters to isolate untrusted content.
- Capability inventory: Subprocess execution is restricted to gh, git, and internal Python scripts in scripts/babysit_util.py.
- Sanitization: The skill uses structural delimiters and explicit model instructions to ignore any embedded commands within the PR data.
- [COMMAND_EXECUTION]: The skill executes shell commands at load time using dynamic context injection in SKILL.md.
- Evidence: Commands like git branch, git status, and gh api are used to provide the agent with current repository and login context. These are benign environmental probes.
- [COMMAND_EXECUTION]: The skill utilizes subprocess calls to interact with system version control and GitHub CLI tools.
- Evidence: scripts/babysit_util.py implements a run_command helper that wraps subprocess.run. The implementation follows security best practices by disabling shell execution and enforcing a strict allowlist of permitted binaries (git, gh).
Audit Metadata