Pr Description Generator
Analysis
This skill appears to locally generate PR descriptions from git changes, with expected local git usage and no evidence of credential use, network exfiltration, or autonomous account changes.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
python3 scripts/generate_pr_description.py --repo /path/to/repo ... --output pr-body.md ... --copy
The skill documents user-controlled repository selection plus optional file output and clipboard copying. These are purpose-aligned for generating a PR body, but they are local-environment interactions users should invoke deliberately.
Source: unknown; Homepage: none; Required binaries (all must exist): none
The package has limited provenance metadata, and the registry does not declare required binaries even though the skill documentation says it uses the git CLI. No remote install script, unpinned package install, or hidden dependency is evidenced.
cmd = ['git'] + args ... subprocess.run(cmd, capture_output=True, text=True, cwd=cwd, timeout=30)
The script executes the local git CLI to collect diffs and logs. This command execution is central to the stated purpose and uses argument lists rather than a shell in the visible code.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
commits_text = get_commits(base, cwd); changed_files = get_changed_files(base, cwd); diff_text = get_diff(base, cwd)
The skill builds PR text from repository context such as commit messages, changed files, and diffs. That is expected, but commit messages and filenames can contain sensitive or misleading text that may be carried into the generated PR description.