babysit
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to extract and execute commands found in CI workflow files at runtime to reproduce failures locally.
- Evidence: The instruction in
SKILL.mdstates: "open the workflow file, take the exact command the failing job runs, and reproduce it locally." - [COMMAND_EXECUTION]: The agent is granted authority to execute shell commands to diagnose and fix failing checks, which involves running scripts or binaries defined within the repository's configuration.
- Evidence: The 'Authority' section grants power to "diagnose failing checks" and the 'Fix' section requires the agent to "Run the failing check locally until green."
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests untrusted data from external sources (CI logs and PR metadata) that could contain instructions designed to manipulate the agent.
- Ingestion points: Reads job logs via
gh run view <run-id> --log-failedand repository workflow files. - Boundary markers: None specified to delimit log content from instructions.
- Capability inventory: Execution of local shell commands, git commits, git pushes, and GitHub API interactions.
- Sanitization: No sanitization or validation of log content is mentioned before the agent uses it for diagnosis.
Audit Metadata