clawhub-installer
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads content from the GPTomics GitHub repository (
https://github.com/GPTomics/bioSkills.git). This is documented as a vendor resource for the skill author. - [REMOTE_CODE_EXECUTION]: The installation script clones a remote repository and executes a shell script (
install-openclaw.sh) contained within that repository. This pattern is secured by a hardcoded commit hash verification (EXPECTED_COMMIT) which ensures only specific, audited versions of the remote code are executed. - [COMMAND_EXECUTION]: The script performs standard file system operations, such as creating directories in
$HOME/.openclawand removing existing skill directories during uninstallation. These operations are restricted to the application's own configuration space.
Audit Metadata