babysit-prs

SUSPICIOUS: The skill’s GitHub-focused capabilities are broadly aligned with its purpose and its network/data flows remain on official GitHub paths, so it does not look like credential theft or malware. However, it grants a self-scheduling agent the ability to read attacker-controlled PR text, execute local verification commands, push commits, post replies, and resolve threads over repeated passes without per-pass approval, which is a high-impact autonomous workflow and a non-trivial indirect prompt-injection risk.