watch-pr
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill relies on local scripts and well-known system utilities (
gh,jq) to perform its tasks. It does not download external code or execute scripts from untrusted remote sources. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external PR comments and reviews.
- Ingestion points: External reviews and comments are fetched from the GitHub API in
scripts/watch-pr.sh. - Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the data entering the agent's context.
- Capability inventory: The agent is permitted to draft code, run local build/test tools (
mix), and read CI logs. - Sanitization: While the script uses
jqfor structural integrity of the JSON data, the textual content of the PR comments is not sanitized to prevent instruction injection. - Mitigation: The skill's 'Iron Laws' explicitly mandate human approval for any automated reply or code push, providing a strong defense against autonomous exploitation by malicious PR content.
Audit Metadata