babysit-pr-to-pass-ci
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions targeting the agent's logic.
- Ingestion points: The skill reads pull request diffs, GitHub Action job logs, and workflow files (
SKILL.md). - Capability inventory: The agent has the authority to write to the filesystem, commit code, push to remote repositories, and rerun GitHub Actions jobs.
- Sanitization: There are no explicit instructions for sanitizing or escaping the content of logs or diffs before they are processed by the LLM.
- Boundary markers: The skill does not define strict delimiters (like XML tags or unique markers) to isolate untrusted log/diff content from the agent's primary instructions.
- [COMMAND_EXECUTION]: The skill utilizes command-line tools to interact with the repository and CI environment.
- Evidence: It executes
gh run rerunto trigger GitHub Actions and usesgitcommands for committing and pushing code changes. These actions are performed as part of the intended babysitting functionality but represent a significant capability tier when combined with the ingestion of untrusted data.
Audit Metadata