claw-integration-design
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by recommending multi-tenant scoping (
tenant_id), granular resource-level permissions (e.g.,write:invoices), and audit logging for traceability. - [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. All references to API keys (e.g.,
sk_...) and OAuth2 tokens (e.g.,<access_token>) are clearly marked as placeholders for documentation purposes. - [EXTERNAL_DOWNLOADS]: The skill does not perform any external downloads or package installations. It provides links to well-known services (e.g., Pinecone, Weaviate, OpenAI) for vector search implementations, which is standard for the described use case.
- [INDIRECT_PROMPT_INJECTION]: While the skill designs endpoints that ingest agent input, it explicitly recommends validation, scoping, and human-review patterns (e.g., 'reviewed by you before saving') to mitigate risks associated with untrusted agent data.
- [NO_CODE]: The skill consists entirely of instructional markdown, YAML configuration, and JSON templates. No executable scripts or binaries are included.
Audit Metadata