Skills
Navigate
skills/tbhb/vale-ai-tells/watch-pr/Gen Agent Trust Hub

watch-pr

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted strings from external GitHub pull request check names and URLs, creating a surface for indirect prompt injection.\n
  • Ingestion points: The scripts/watch-checks.sh script fetches check data via the gh pr checks command.\n
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within the job names or links reported.\n
  • Capability inventory: The agent has broad execution capabilities via the Monitor and Bash tools, which could be abused if an injected instruction is followed.\n
  • Sanitization: While the script uses jq for JSON parsing, the resulting output interpolated into the agent's context (job names and links) is not escaped or sanitized.\n- [COMMAND_EXECUTION]: The skill executes local bash scripts and utilizes standard command-line utilities like gh and jq to monitor pull request status.\n
  • Evidence: Execution of scripts/watch-checks.sh and scripts/guard-watch.sh within the Bash and Monitor tools.\n
  • Hardening: Both scripts implement environment hardening by pinning LC_ALL=C and unsetting variables that could silently retarget commands, such as GH_REPO, GH_HOST, and CDPATH.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:23 AM