looper-pr-takeover
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) andgitto interact with pull requests. These are standard development tools and are used here for their intended purpose of PR management. - [EXTERNAL_DOWNLOADS]: The skill mentions fetching extended guidelines from a GitHub repository (
https://raw.githubusercontent.com/nexu-io/looper/main/skills/looper-looper-looper-pr-takeover/references/github-commands.md). Per safety guidelines, this is documented neutrally as it targets a well-known service (GitHub). - [REMOTE_CODE_EXECUTION]: The skill mentions an optional 'Mode B' using the
looperdaemon. While this involves a third-party tool, the skill provides a link to its official source and instructs the agent to only use it if already installed and explicitly requested by the user. - [PRIVILEGE_ESCALATION]: The skill explicitly forbids using
--adminto bypass required checks during merging and prohibits force-pushing, which protects against common repository privilege abuses. - [SAFE]: The skill includes extensive safety rails, such as stopping and asking for human intervention when blockers occur or when multiple fix attempts fail.
Audit Metadata