Skills
Navigate
skills/tbhb/vale-ai-tells/codex-watch-pr/Gen Agent Trust Hub

codex-watch-pr

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local bash script scripts/watch-checks.sh which interacts with the gh (GitHub CLI) and jq tools. The script includes environment hardening (unsetting GH_REPO, CDPATH, etc.) to prevent external environment variables from hijacking command behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub's API (check names and status). It uses jq to strictly parse the JSON response and only emits specific fields (status, job name, and link). The risk of the agent misinterpreting check names as instructions is low and characteristic of standard development tools.
  • [DATA_EXPOSURE]: Access is limited to pull request metadata via authorized GitHub CLI sessions. No sensitive local files or credentials are accessed or transmitted.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:22 AM