Merge Check

Analyze a GitHub pull request for mergeability — predict whether it will get merged based on technical, architectural, process, social, and compliance factor...

This skill appears to do what it says (gather PR data and produce a mergeability report), but it omits key operational details. Before running/installing: 1) Inspect the script yourself (it is included) to confirm you're comfortable with gh API calls. 2) Ensure you have gh and jq installed; the skill should have declared those as required. 3) Be aware the script will use your GitHub CLI authentication (your gh auth or GH_TOKEN) to read repository and PR data — run it only with an account/token that has appropriate (least-privilege) access. 4) If you want tighter safety, run the script in an isolated environment or with a read-only token; ask the publisher to update metadata to list required binaries and explicit credential guidance.

Type: OpenClaw Skill Name: merge-check Version: 1.0.0 The skill is classified as suspicious due to its reliance on executing a shell script (`scripts/merge-check.sh`) that performs extensive network calls to the GitHub API using the `gh` CLI. While the script's purpose is aligned with gathering data for PR analysis and shows no explicit malicious intent (e.g., data exfiltration, persistence, or arbitrary code execution), the use of `gh api` implies interaction with an external service and relies on the `gh` CLI's authentication token, which may possess broad permissions. This represents a powerful capability and potential attack surface if the underlying token is over-privileged or the script were to be modified, aligning with the 'risky capabilities without clear malicious intent' threshold.