open-persona

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes command-line tools including npx, openclaw, and gh to manage persona life cycles. These operations are performed in response to explicit user instructions for creating, installing, or publishing personas.
  • [EXTERNAL_DOWNLOADS]: The skill references external registries such as openpersona.co, clawhub.ai, and npmjs.org to search for and install additional capabilities. These are standard resources within the framework's ecosystem for resolving dependencies.
  • [DYNAMIC_EXECUTION]: The framework generates local scripts (e.g., state-sync.js, economy-hook.js) within the persona packages it creates. These scripts are rendered from predefined templates within the framework rather than downloaded from remote sources at runtime, following a standard code generation pattern.
  • [CREDENTIALS_SAFE]: The skill documentation explicitly instructs the agent and user not to embed secrets like API keys into generated personas. It recommends using environment variables and host-level credential stores, and ensures that sensitive files like acn-registration.json are excluded from exports via .gitignore.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:40 AM