babysit-pr
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub Pull Request comments, review threads, and CI logs which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Data is ingested through
gh pr view, GraphQL queries forreviewThreads, and CI run logs. - Boundary markers: The instructions do not define boundary markers or explicit delimiters to isolate external feedback from the skill's core instructions.
- Capability inventory: The skill has the capability to modify the filesystem, execute development tools (e.g.,
git,fmt,clippy,test,taplo,deny), and push code changes to a remote repository viagit push. - Sanitization: There is no programmatic sanitization of the input; the skill relies on the agent's ability to "verify the claim first" and "escalate security decisions" to a human user.
Audit Metadata