repo-watch
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local helper script located at
~/.claude/scripts/repo-watch.shto identify repositories. - [COMMAND_EXECUTION]: The skill utilizes the
gh(GitHub) CLI to perform several operations, including repository cloning (gh repo clone), issue creation (gh issue create), and API interaction (gh api). - [INDIRECT_PROMPT_INJECTION]: The skill's workflow depends on external data fetched from GitHub (issue reactions) to trigger automated actions like cloning repositories or modifying the
CLAUDE.mdfile. - Ingestion points: Fetches reaction data from the GitHub API using
gh api "repos/{gh_org}/{repo}/issues/{number}/reactions". - Boundary markers: None explicitly defined for the external API response.
- Capability inventory: The agent can write to local configuration files (
CLAUDE.md), clone external repositories to the local system, and close issues. - Sanitization: The logic includes a validation step that filters reactions by a specific
owner_accountand checks for specific content (👍 or 👎), which significantly reduces the risk of manipulation by third parties.
Audit Metadata