openclaw-pr-batch-sweep
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull requests, including titles, descriptions, and code deltas.
- Ingestion points: Untrusted content enters the agent context via the
ghxtool as implemented inscripts/hydrate-candidates.mjsand processed in sub-agent lanes described inSKILL.md. - Boundary markers: The
references/worker-contract.mdfile contains an 'Untrusted Contributor Boundary' section that explicitly instructs agents to treat contributor content as untrusted and never follow embedded instructions. - Capability inventory: The skill performs command execution via
ghx,gitcrawl, andgwt, and maintains the capability to merge pull requests. - Sanitization: The workflow requires agents to summarize evidence for human review rather than executing contributor commands directly, and utilizes
Testbox/Crabboxfor executing untrusted code. - [COMMAND_EXECUTION]: The skill invokes the
ghxbinary and other repository management tools such asgitcrawlandgwtfor pull request discovery, metadata hydration, and worktree management. These operations are core to the skill's stated purpose of PR sweeping.
Audit Metadata