Babysit PrCAUTION

A framework for building agentic apps

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: babysit-pr
description: >-
  Monitor a PR and fix CI or review feedback. Use standalone, or from /ship to
  continue through its authorized guarded merge instead of stopping at green.
user-invocable: true
scope: dev
metadata:
  internal: true
---

Monitor PR #$ARGUMENTS in the current repo and fix CI failures and human or bot
review feedback. A standalone `/babysit-pr` may stop after 30 minutes of green
CI and no new feedback. When invoked by `/ship`, honor its inherited
`ship_mode` and reuse `/ship`'s same-thread heartbeat in Codex; do not create a
second automation. Standalone `/babysit-pr` stays foreground-only and does not
create or resume an automation unless the user explicitly asks for recurring
follow-up. Do not use PR leases.

A request to monitor or fix a PR does not authorize pushing to a PR authored by
someone else. Push to that PR only when the user explicitly authorizes a push to
that exact PR in the current request. A linked PR or inherited general ship
authorization is insufficient. That permits only a push; merging that PR needs
separate authorization in the current request. Before an authorized push,
verify the live PR author, head repository, branch, head OID, and base; recheck
the head before every normal fast-forward push.

Before each push, resolve the active GitHub login with `gh api user --jq .login`,
include `author` in the live PR query, and compare `author.login` with that
login. If they differ, require the current-request authorization for that exact
PR.

Determine comment authorization from the live PR author before drafting or
posting any PR communication. On a PR authored by the active user, concise
replies in existing review threads and a concise top-level recap when feedback
appears only in a review body are routine dispositions and need no extra
authorization. This covers only comments needed to fix, decline, or otherwise
disposition review feedback; do not add proactive or unrelated comments, tags,
assignments, or mentions without an explicit request. On another person's PR,
do not post any comment, including an inline reply or review-body recap, unless
the current request explicitly authorizes commenting on that exact PR. Review,
monitor, fix, push, or merge authorization alone does not authorize comments.
Without that authorization, draft the response, leave the feedback unresolved,
and do not claim the PR is ready or merge it.

A worktree is a valid PR checkout. When monitoring from one, keep Git and
GitHub commands in that worktree's cwd and current branch; do not copy changes
to the shared checkout or require that an agent publish from the root checkout.

In a shared checkout, keep its branch unchanged. When the user explicitly asks
to update this PR and the checkout cannot safely serve as its source, follow
`new-branch` to isolate the PR work in a managed task-owned worktree without
asking. Carry only changes belonging to this PR. If they cannot be isolated
safely, preserve state and report the exact paths or commits without asking
for branch or worktree permission.

For an existing PR update, record `headRepository.nameWithOwner`, `headRefName`,
and `headRefOid`, then base the isolated task branch on that exact head. Resolve
a remote for that exact head repository; `origin` is correct only when its URL
matches. If needed, add a uniquely named remote for the verified head
repository. Never infer the push target from the base repository or a matching
branch name. If no writable head repository is available, preserve state and
report the blocker.

`ship:push` always commits publishable paths and pushes `origin/<local branch>`.
Use it for an existing PR only when `origin` matches the recorded head
repository and the local branch name equals `headRefName`. Otherwise, stage
only this task's paths, commit with a specific subject, and push
`HEAD:refs/heads/$headRefName` to `head_remote` after rechecking the live OID.
Before each push, inspect any worktree using that head branch for unpublished
PR commits. If the head moved, follow Setup's non-fast-forward recovery: fetch
the refreshed head and merge it into the clean task branch, resolve and test,
then recheck before pushing. Preserve state and report only when peer or
unpublished work, or conflicts that cannot be safely resolved, block recovery.
Never replace an existing PR's history, rebase, or force-push.

## Branch-wide Snapshot Rule

During `/babysit-pr`, the PR remains the unit of review and the shared checkout
is the branch snapshot. At the first tick, record dirty paths and unpushed
commits; publish the requested initial work only after verifying that every
candidate belongs to this PR's requested fix. If unrelated or incomplete
concurrent work is present in a shared checkout, continue in the managed
worktree using the existing PR's live head and carry only this task's fixes.
Preserve the shared checkout. If safe isolation is impossible, report exact
paths or commits without asking. On later ticks, inspect the tree before every
push. Publish only a complete, coherent set of currently known fixes for
failing CI, PR feedback, a real merge conflict, or an explicit user request.
Batch multiple feedback items and delegate changes into one update; do not
create a commit for each finding, checkpoint, or timer tick. Every new head
reruns affected checks and resets the soak. Publish to the verified PR target
as described above; `ship:push` rejects an omitted or generic subject. A clean
tree, `origin/main` drift, queued checks, or a timer tick is not a reason to
commit or push. Never publish unrelated concurrent work, and never revert,
stash, or overwrite it.

When an actionable fix is changing, collect all known related CI and review
findings, validate the combined fix, then publish one coherent snapshot to the
existing PR. Do not push incremental snapshots just to start CI early; the
latest head needs a stable run before merge. The final clean-tree and
merge-soak gates still apply before mergin

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills/an

.agents/skills/content-product-development

.agents/skills/design-exploration

.agents/skills/turn-into-app

.agents/skills/visual-edit

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Babysit Pr](https://modelsatlas.com/skills/builderio/babysit-pr/badge.svg)](https://modelsatlas.com/skills/builderio/babysit-pr/)

Not your listing, or something out of date? Claim or update your listing.