babysit-pr
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from GitHub Pull Requests, including comments and reviews, which may contain instructions from untrusted external contributors.
- Ingestion points: The scripts/pr-wait script fetches and prints PR metadata, comments, and review threads; SKILL.md directs the agent to read rules from .macroscope/check-run-agents/*.md files in the repository.
- Boundary markers: Absent; the content is streamed directly from the script output to the agent's monitoring tool.
- Capability inventory: The skill enables the agent to perform code modifications, git rebases, and pull request merges.
- Sanitization: Absent; while the script removes HTML tags, it does not filter natural language content. The skill mitigates this by instructing the agent to verify bot feedback against the source and requiring explicit user authorization before merging.
- [COMMAND_EXECUTION]: The provided Python script executes the GitHub CLI (gh) to retrieve repository and pull request data.
- Evidence: Numerous subprocess.run calls to the gh tool are used throughout the scripts/pr-wait script.
- Security: Input parameters such as repository names and pull request numbers are strictly validated using regular expressions in the parse_target function to prevent command injection.
Audit Metadata