pr-watch-fix-renovate
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to interact withgitand the GitHub CLI (gh). These commands are used to list pull requests, check out branches into worktrees, and prune stale worktrees, which aligns with the skill's stated purpose. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted pull request metadata (titles and branch names) from GitHub and interpolates them into sub-agent prompts. * Ingestion points: Pull request data retrieved via
gh pr listin Step 1 ofSKILL.md. * Boundary markers: The orchestrator uses specific placeholders (<TITLE>,<BRANCH>) in the sub-agent prompt but does not employ hardened security delimiters. * Capability inventory: Sub-agents have access to theBashandAgenttools, enabling them to execute the/pr-watch-fixlogic which involves file modifications and git commits. * Sanitization: No explicit validation or escaping is applied to the PR metadata before it is passed to the sub-agents.
Audit Metadata