Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
pr-pilot
v1.0.0Submit professional pull requests and manage their full lifecycle — from push to merge. Covers PR creation with structured descriptions, CI monitoring, revie...
⭐ 0· 52·0 current·0 all-time
byBijin@sliverp
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (create and manage GitHub PRs) legitimately requires Git and the GitHub CLI plus a GitHub token; the instructions reflect that. However, the registry metadata lists no required binaries or environment variables, which is inconsistent with the actual runtime needs.
Instruction Scope
SKILL.md instructs the agent/user to run git and gh commands, push branches, create PR bodies in /tmp/pr_body.md, and to obtain/set a GH_TOKEN and GitHub username. Those instructions are within the PR-management purpose, but they reference an environment secret (GH_TOKEN) and local repo operations even though those were not declared in the skill manifest — a scope mismatch that could be surprising to users or to automated policy checks.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That reduces risk from hidden downloads or installs; nothing is written to disk by the skill package itself.
Credentials
Although the runtime requires a GitHub personal access token and a username, the skill did not declare any required environment variables or a primary credential. A GH token grants access to repositories and (depending on scopes) can modify code — requesting or using such a token should be declared explicitly and scoped minimally.
Persistence & Privilege
The skill does not request always: true, does not install persistent components, and is user-invocable. Agent autonomous invocation is allowed by default (disable-model-invocation=false) but that is expected platform behavior and not, by itself, an additional red flag here.
What to consider before installing
This skill appears to be a legitimate PR workflow, but the published metadata fails to declare that it needs the GitHub CLI and a GH_TOKEN. Before installing or running it: (1) verify you or the agent will only provide a least-privilege GitHub token (restrict scopes to what's necessary, e.g., repo: statuses if possible), (2) prefer running the gh/git commands yourself in a local clone rather than handing your token to an automated agent, (3) confirm the agent will not exfiltrate tokens or run commands on unrelated repos, (4) inspect any prompts or generated /tmp/pr_body.md content before allowing push/create actions, and (5) ask the skill author/registry to update the metadata to explicitly declare required binaries (gh) and required env (GH_TOKEN, GITHUB_USERNAME) so the runtime expectations match what the skill actually does.Like a lobster shell, security has layers — review code before you run it.
latestvk978n8kbdgb1sfa5p0x9a7f40n83gb0x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.