takeover
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and acting upon untrusted data from external development sources.
- Ingestion points: The agent is instructed to read source pull requests, branches, and threads in
SKILL.md. - Boundary markers: Absent; there are no explicit instructions to use delimiters or to treat embedded instructions in the source text as non-executable data.
- Capability inventory: The skill has the ability to write data and interact with external APIs through tools like
file-pr,babysit-pr, andleaving-pr-comments. - Sanitization: Absent; the skill does not mention any validation, filtering, or escaping of the inherited data before it is used in the agent's context.
Audit Metadata