poteto-mode
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently interacts with external, untrusted data sources which introduces an indirect prompt injection surface.
- Ingestion points: The agent ingests external text, including pull request descriptions, titles, comments, automated review feedback (Bugbot), and issue text across
SKILL.md,playbooks/babysit.md, andreferences/bugbot-triage.md. - Boundary markers: Explicit boundary delimiters or structural markers are absent for enclosing user-provided or external text chunks within prompts.
- Capability inventory: The agent possesses extensive local command execution capabilities, including file modifications, git operations (
git worktree), and GitHub CLI invocations (gh pr view,gh pr checks). - Sanitization: The skill implements a robust defensive control in
playbooks/babysit.md, instructing the agent to pass comment text exclusively as data to APIs and never interpolate or execute it as shell code.
Audit Metadata