dangerous-action-guard
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a structured framework for intercepting dangerous operations such as file destruction, forced git updates, and infrastructure changes. This is a defensive tool that enhances overall system security.
- [SAFE]: The audit trail manager (
audit.py) correctly usesyaml.safe_load()to process its state files, which is a best practice for preventing YAML deserialization attacks. - [INDIRECT_PROMPT_INJECTION]: The skill processes and logs external input, including command descriptions and user confirmation phrases. These logged values represent a vulnerability surface as they are displayed to the terminal without sanitization for control characters or escape sequences.
- Ingestion points: Command-line arguments passed to
audit.py(--pending,--confirm,--phrase,--scope). - Boundary markers: Not present in the audit trail manager.
- Capability inventory: Local file system read/write access limited to the skill's specific state directory (
~/.openclaw/skill-state/dangerous-action-guard/). - Sanitization: No sanitization is performed on input strings before they are persisted to YAML or displayed via the
--historycommand.
Audit Metadata