babysit-pr
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule inscripts/gh_pr_watch.pyto execute various GitHub CLI (gh) commands. These operations are core to the skill's functionality, allowing it to view PR metadata, check status, and interact with the GitHub API using structured command lists. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external data from GitHub review comments and CI logs to determine its next actions.
- Ingestion points: The agent fetches external content through the GitHub API using the
fetch_new_review_itemsfunction inscripts/gh_pr_watch.py. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to isolate untrusted external comment text from the agent's internal logic.
- Capability inventory: The agent has the authority to modify local source code, create commits, and push to remote branches based on its interpretation of the feedback, as described in
SKILL.md. - Sanitization: The script does not perform sanitization or validation on the text of the review comments before the agent evaluates them for 'actionability'.
Audit Metadata