babysit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited babysit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
GOAL: PR #$1 reaches reviewDecision == APPROVED — a fresh approval on the current head commit — with all CI checks green and mergeable == MERGEABLE. Loop until then. A human still does the merge; you never merge.
Repo: the 2nd argument if given, otherwise the current repo (gh repo view --json nameWithOwner --jq .nameWithOwner).
To make it loop until the goal, run me under the loop skill: /loop /babysit $1 (self-paced — each pass does one check-react cycle, then either declares the goal met and ENDS the loop, or continues. You can also run me once for a single review-react pass.)
Co-Authored-By trailer.In the snippets below, substitute the PR number and repo you were invoked with literally — don't rely on bash$1/$2(those are command-template args, not shell positionals).
PR=<pr-number>; REPO=<owner/repo>; ME=$(gh api user --jq .login)
gh pr view "$PR" --repo "$REPO" --json reviewDecision,mergeable,state,headRefName
gh pr checks "$PR" --repo "$REPO"
# latest review from a non-self author (your own reply-comments surface as reviews — exclude them):
gh api "repos/$REPO/pulls/$PR/reviews" --jq --arg me "$ME" '[.[]|select(.user.login!=$me)]|max_by(.id)|{id,user:.user.login,state}'reviewDecision == APPROVED (fresh, i.e. a non-self APPROVED review id newer than your last push) and every CI check passes and mergeable == MERGEABLE: report the green light, notify the user, tell them a human still merges, and END the loop (do not schedule another iteration).dismiss_stale_reviews) — check before assuming either way. Regardless, avoid pushing cosmetic/non-blocking fixes once approved: every push re-triggers CI + a fresh review, which can flip the verdict. Fix blocking findings; leave nice-to-haves for a moment you're re-opening anyway (e.g. an update-with-base). gh api "repos/$REPO/pulls/$PR/reviews/<REVIEW_ID>" --jq '.body'
gh api graphql -f query='query($o:String!,$r:String!,$p:Int!){repository(owner:$o,name:$r){pullRequest(number:$p){reviewThreads(first:100){nodes{id isResolved comments(first:1){nodes{databaseId path line body}}}}}}}' -f o="${REPO%/*}" -f r="${REPO#*/}" -F p="$PR" \
--jq '.data.repository.pullRequest.reviewThreads.nodes[]|select(.isResolved==false)|"thread=\(.id) cmt=\(.comments.nodes[0].databaseId) \(.comments.nodes[0].path):\(.comments.nodes[0].line)\n\(.comments.nodes[0].body)"'git commit (conventional + Co-Authored-By), reply on the thread (fix + SHA), resolve the thread.gh api "repos/$REPO/pulls/$PR/comments/<COMMENT_DB_ID>/replies" --method POST -f body="✅ Fixed in <sha>. <what changed>" # or pushback reasoning
gh api graphql -f query='mutation($id:ID!){resolveReviewThread(input:{threadId:$id}){thread{isResolved}}}' -f id="<THREAD_NODE_ID>"If the repo has an automated reviewer (a QA bot posting reviews or commit statuses), learn its shape on the first pass and treat it accordingly:
test() filters with real gh when unsure.gh auth status stays clean). Retry once; if it persists on a write, fall back to the REST equivalent.Goal met → report it, notify the user, remind them a human merges, and stop looping (omit the next iteration).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.