git-upstream-pr-diverged
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!syntax inSKILL.mdto execute shell commands at load time for context gathering. Specifically, it runsgit branch,git status,git remote -v, andfindto locate its configuration. These operations are benign and used solely to populate the agent's context with relevant project information. - [COMMAND_EXECUTION]: The skill is designed to execute developer tools (
git,gh,uv,pytest,ruff,python3) and allows for user-defined linting and testing commands via a local configuration file (.claude/upstream-pr.local.md). All shell executions in the provided scripts are properly quoted to prevent command injection. - [DATA_EXPOSURE]: The skill accesses git remotes and commit history. While this exposes repository structure and remote URLs, it is necessary for the intended purpose of submitting Pull Requests to upstream repositories. No access to sensitive system files or credentials (like SSH keys) was found.
Audit Metadata