ds-watch-pr
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the GitHub CLI tool (
gh) viasubprocess.runinscripts/watch_pr.pyto monitor the status of pull requests. The commands are passed as argument lists, which prevents shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from GitHub PR comments and reviews to guide the agent's code-fixing behavior.
- Ingestion points: The
scripts/watch_pr.pyscript retrieves PR comments and reviews using thegh pr viewcommand and prints them for the agent to process. - Boundary markers (absent): There are no specific delimiters or instructions to ignore embedded commands within the fetched pull request metadata.
- Capability inventory: The agent is instructed to modify local files, run tests or "checks" locally, and perform
git push --force-with-leaseoperations. - Sanitization (absent): The skill lacks input sanitization or validation, relying instead on the agent's capability to "Decide if the finding is real" and distinguish between legitimate bugs and malicious or out-of-scope requests.
Audit Metadata