distill-pr-intent
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local repository scripts (
scripts/pr review-init,scripts/pr review-checkout-pr) and shell commands to manage Git state and set up the environment. These are standard development operations within the specified repository environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Pull Request diffs to generate an intent memo, which creates a surface for indirect prompt injection.
- Ingestion points: The agent reads the output of
git diffcommands (stored in.local/intent.patch.txt,.local/intent.name-status.txt, and.local/intent.stat.txtin SKILL.md) to infer author intent. - Boundary markers: The instructions lack explicit delimiters or warnings to the model to treat the diff content as untrusted or to ignore instructions embedded within code comments or PR metadata.
- Capability inventory: The skill executes shell commands (
git,scripts/pr) and writes to local files within the/var/lib/clawd/repos/openclawdirectory. - Sanitization: No sanitization, filtering, or escaping of the diff content is performed before the model processes it for distillation.
Audit Metadata