PR + Commit Workflow

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI06: Memory and Context Poisoning

What this means

Private prompts, secrets, internal context, or sensitive project details could be exposed in a PR, including in public repositories.

Why it was flagged

This directs the agent to retrieve local/persistent prompt history and publish it in the PR body. The scope of what history is included is not tightly bounded, and redaction is left to the agent.

Skill content

Prefer agent history search tools (`cm`/`cass`, Codex logs, etc.) ... Include the full prompt history verbatim; do not omit prompts. If a prompt contains sensitive info, redact only the sensitive portion

Recommendation

Limit prompt history to the current task, require explicit user review before publishing, redact aggressively, and consider using summaries instead of verbatim prompts.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may create or edit PRs under the user's account as part of the workflow.

Why it was flagged

The skill instructs the agent to perform GitHub PR mutations. This is purpose-aligned, but it can publish or update repository-visible content.

Skill content

Use `/tmp` + `gh pr edit --body-file` for updates. Create PR with `gh pr create` if not already open.

Recommendation

Review the branch, PR body, target repository, and visibility before allowing `gh pr create` or `gh pr edit` to run.

Note

ASI03: Identity and Privilege Abuse

What this means

Actions may be taken using whichever GitHub account and repository permissions are active locally.

Why it was flagged

These commands normally use the user's authenticated GitHub CLI session, so the workflow relies on delegated GitHub account authority even though no credential is declared.

Skill content

gh pr edit --body-file ... gh pr create

Recommendation

Confirm `gh auth status`, the target repository, and the active branch before using the skill.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user could install a different or changed remote version if they follow the README instead of the reviewed artifact contents.

Why it was flagged

The README gives a remote clone instruction rather than a pinned install mechanism. The provided artifact set is small and readable, but provenance should be verified before installation.

Skill content

Install the PR workflow skill from https://github.com/joshp123/pr-workflow-skill — clone it to wherever I keep skills

Recommendation

Install from a verified source or pinned commit, and inspect the files before enabling the skill.