pr-worktree
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
pr-worktree.shexecutes several system commands includinggitandgh. These are used to detect repository state, push code to remote branches, and manage GitHub Pull Requests. - [COMMAND_EXECUTION]: The
SKILL.mdfile instructs the AI agent to execute local build and validation tools such asnpm run build,npx tsc,npx eslint, andnpm testto verify the codebase before pushing. - [COMMAND_EXECUTION]: The skill attempts to execute a validation script from a related skill if present (
~/.pi/agent/skills/merge-worktree/pre-merge-check.sh). This facilitates integration between development-oriented skills. - [DATA_EXFILTRATION]: The skill is designed to push local code changes to GitHub repositories. This is the explicit and intended primary function of the skill, and it utilizes the user's authenticated GitHub CLI session.
Audit Metadata