babysit-pr
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external sources and possessing write capabilities.
- Ingestion points: Reads pull request metadata, diffs, and CI failure logs using
gh pr view,gh pr diff, andgh run view --log-failed(SKILL.md). - Boundary markers: The instructions do not define boundary markers to separate data from instructions.
- Capability inventory: The agent can modify local files, commit changes, push to remote branches (
git push), and modify PR labels to trigger workflows (gh pr edit) (SKILL.md). - Sanitization: There is no evidence of sanitization or filtering of the ingested logs or diff content.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) andgitto interact with theNVIDIA-NeMo/NeMorepository. These are standard operations for its intended purpose.
Audit Metadata