skills/trailofbits/coop/babysit-pr/Gen Agent Trust Hub

babysit-pr

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub Pull Request comments, review threads, and CI logs which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Data is ingested through gh pr view, GraphQL queries for reviewThreads, and CI run logs.
  • Boundary markers: The instructions do not define boundary markers or explicit delimiters to isolate external feedback from the skill's core instructions.
  • Capability inventory: The skill has the capability to modify the filesystem, execute development tools (e.g., git, fmt, clippy, test, taplo, deny), and push code changes to a remote repository via git push.
  • Sanitization: There is no programmatic sanitization of the input; the skill relies on the agent's ability to "verify the claim first" and "escalate security decisions" to a human user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 09:49 PM
Security Audit — agent-trust-hub — babysit-pr