babysit-my-prs

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub PR comments and reviews to classify and act on PRs, which creates a surface for instructions embedded in those comments to influence agent behavior.
  • Ingestion points: Reads PR comments, inline review threads, and top-level reviews.
  • Boundary markers: The instructions do not provide delimiters or specific markers to isolate external content from the agent's instructions.
  • Capability inventory: The agent is authorized to perform git operations (push) and delegate tasks to other workers.
  • Sanitization: No sanitization or validation logic is specified for the external PR data before processing.
  • [PERSISTENCE]: The skill implements a persistence mechanism via scheduled monitoring sweeps.
  • Evidence: The skill instructs the agent to schedule sweeps with a non-overlapping cadence and maintain state outside the repository.
  • [COMMAND_EXECUTION]: The skill uses command-line tools to interact with GitHub and Git repositories.
  • Evidence: Uses gh for user and repository discovery and git for worktree management and branch updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 09:49 PM
Security Audit — agent-trust-hub — babysit-my-prs