make
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and executes the
@useclawlink/clipackage from the NPM registry vianpx. This is the primary method for delivering the vendor's integration tools. - [REMOTE_CODE_EXECUTION]: The use of
npxresults in the execution of remote code from the official NPM registry. This behavior is expected for the functionality described. - [COMMAND_EXECUTION]: The skill relies on shell commands to interact with the Make API through the ClawLink CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied input strings and JSON data to perform Make actions, which represents an entry point for untrusted data.
- Ingestion points: User input strings passed to
npx @useclawlink/cli actions makeand JSON data passed tonpx @useclawlink/cli run make. - Boundary markers: None present in the skill instructions.
- Capability inventory: Command execution for API interaction.
- Sanitization: Relies on the CLI tool and LLM guardrails for processing data.
Audit Metadata