watch-pr

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill relies on local scripts and well-known system utilities (gh, jq) to perform its tasks. It does not download external code or execute scripts from untrusted remote sources.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external PR comments and reviews.
  • Ingestion points: External reviews and comments are fetched from the GitHub API in scripts/watch-pr.sh.
  • Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the data entering the agent's context.
  • Capability inventory: The agent is permitted to draft code, run local build/test tools (mix), and read CI logs.
  • Sanitization: While the script uses jq for structural integrity of the JSON data, the textual content of the PR comments is not sanitized to prevent instruction injection.
  • Mitigation: The skill's 'Iron Laws' explicitly mandate human approval for any automated reply or code push, providing a strong defense against autonomous exploitation by malicious PR content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 01:40 AM
Security Audit — agent-trust-hub — watch-pr