babysit
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically CI logs and repository workflow files, which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: The skill reads CI logs via
gh run view --log-failedandtea actions runs logs. It also parses repository workflow files to identify commands for local reproduction. - Boundary markers: Absent. The skill does not specify any delimiters or instructions to the agent to ignore potentially malicious embedded content within the logs or workflow files.
- Capability inventory: The skill possesses significant capabilities, including the ability to write to the filesystem (
git commit), perform network operations (git push,gh api,tea api), and execute arbitrary shell commands. - Sanitization: Absent. There is no mention of validating or sanitizing commands extracted from workflow files before they are executed in the local environment.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute commands sourced from the repository's configuration files.
- Evidence: The instruction "Reproduce the failure locally with the exact command the workflow file gives the failing job" creates a direct path for executing potentially malicious code if an attacker can modify a workflow file (e.g., via a pull request from a fork).
Audit Metadata