babysit
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and acts upon untrusted data from GitHub PR comments.
- Ingestion points: The skill reads active unresolved comments (specifically mentioning Bugbot and change requests) from a PR branch using the
ghtool. - Boundary markers: Absent. The instructions do not define clear delimiters or instruct the agent to ignore instructions embedded within the comments.
- Capability inventory: The agent is authorized to resolve merge conflicts (file system writes), fix CI issues (code modification and execution of build/test commands), and push changes to the repository (network operations).
- Sanitization: The skill relies on natural language instructions for validation ("Carefully validate issues reported by Bugbot and only take action on those that are valid") rather than technical filtering or strict schema validation.
- [COMMAND_EXECUTION]: To fulfill its purpose of "fixing CI," the agent will likely need to execute shell commands such as test runners, linters, or build scripts. When combined with the processing of untrusted comments, an attacker could potentially influence the parameters or content of these commands.
Audit Metadata