babysit-pr

Warn

Audited by Runlayer on Feb 23, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
5
Flagged
5
Chunks
8
Flagged Files (5)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/2] Description: --- name: babysit-pr description: Babysit a GitHub pull request after creation by continuously polling CI checks/workflow runs, new review comments, and mergeability state until the PR is ready to merge (or merged/closed). Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and stop only when user help is required (for example CI infrastructure issues, exhausted flaky retries, or ambiguous/blocking

Tool: SKILL.md [2/2] Description: unless a strict stop condition is met. Commit message defaults: - `codex: fix CI failure on PR #<n>` - `codex: address PR review feedback (#<n>)` ## Monitoring Loop Pattern Use this loop in a live Codex session: 1. Run `--once`.

agents/openai.yamlHIGH
78.3%

Malicious tool definition detected

Tool: agents/openai.yaml Description: interface: display_name: "PR Babysitter" short_description: "Watch PR CI, reviews, and merge conflicts"

references/github-api-notes.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/github-api-notes.md Description: # GitHub CLI / API Notes For `babysit-pr` ## Primary commands used ### PR metadata - `gh pr view --json number,url,state,mergedAt,closedAt,headRefName,headRefOid,headRepository,headRepositoryOwner` Used to resolve PR number, URL, branch, head SHA, and closed/merged state.

references/heuristics.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/heuristics.md Description: # CI / Review Heuristics ## CI classification checklist Treat as **branch-related** when logs clearly indicate a regression caused by the PR branch: - Compile/typecheck/lint failures in files or modules touched by the branch - Deterministic unit/integration test failures in changed areas - Snapshot output changes caused by UI/text changes in the branch - Static analysis violations introduced by the latest push - Build script/config changes in the PR ca

scripts/gh_pr_watch.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/gh_pr_watch.py [1/3] Description: #!/usr/bin/env python3 """Watch GitHub PR CI and review activity for Codex PR babysitting workflows.""" import argparse import json import os import re import subprocess import sys import tempfile import time from pathlib import Path from urllib.parse import urlparse FAILED_RUN_CONCLUSIONS = { "failure", "timed_out", "cancelled", "action_required", "startup_failure", "stale", } PENDING_CHECK_STATES = { "QUEUED", "IN_PROGRESS", "PENDING", "WAITING",

Tool: scripts/gh_pr_watch.py [2/3] Description: repo=None, per_page=100): items = [] page = 1 while True: sep = "&" if "?" in endpoint else "?" page_endpoint = f"{endpoint}{sep}per_page={per_page}&page={page}" payload = gh_json(["api", page_endpoint], repo=repo) if payload is None: break if not isinstance(payload, list): raise GhCommandError(f"Unexpected paginated payload from gh api {endpoint}") items.extend(payload) if len(payload) < per_page: break page += 1 return items def normalize_issue_c

Tool: scripts/gh_pr_watch.py [3/3] Description: for item in review_items if isinstance(item, dict) ), tuple(snapshot.get("actions") or []), ) def run_watch(args): poll_seconds = args.poll_seconds last_change_key = None while True: snapshot, state_path = collect_snapshot(args) print_event( "snapshot", { "snapshot": snapshot, "state_file": str(state_path), "next_poll_seconds": poll_seconds, }, ) actions = set(snapshot.get("actions") or []) if ( "stop_pr_closed" in actions or "stop_exhausted_retrie

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
5
Files Flagged
5
Chunks Analyzed
8
Analyzed
Feb 23, 2026, 01:02 AM
Security Audit — runlayer — babysit-pr