openclaw-secret-scanning-maintainer
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it requires the agent to read and process untrusted text from GitHub issue bodies, PR descriptions, and comments.
- Ingestion points: The
fetch-contentcommand retrieves external, attacker-controllable data into the agent's context from file paths defined in metadata. - Boundary markers: There are no specified delimiters or 'ignore instructions' warnings when passing external content to the agent for redaction analysis.
- Capability inventory: The skill possesses significant write capabilities via the
secret-scanning.mjsscript, including deleting comments (delete-comment), creating new comments (recreate-comment), and modifying issue/PR bodies (redact-body). - Sanitization: While the script uses
@filefor body uploads to mitigate shell injection, it does not sanitize the text against semantic prompt injection attacks. - [COMMAND_EXECUTION]: The skill executes a local Node.js management script (
secret-scanning.mjs) to perform GitHub operations. The script takes arguments derived from the agent's processing of untrusted data, which could lead to unexpected behavior if input validation is bypassed via prompt injection.
Audit Metadata