cloud-claw-launch-agent
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Executes local CLI commands such as 'altllm' and 'node dist/cli.js' to manage cloud infrastructure deployments based on user-provided parameters.
- [INDIRECT_PROMPT_INJECTION]: Ingests untrusted user input including deployment names and bot tokens which are passed as arguments to shell commands. * Ingestion points: User-supplied 'name', 'agentType', and secret tokens in SKILL.md. * Boundary markers: Regex constraint '^[a-z0-9-]+$' for deployment names defined in SKILL.md. * Capability inventory: Shell command execution via 'node dist/cli.js' documented in references/cli-reference.md. * Sanitization: Instructions explicitly require regex validation for the 'name' field to mitigate command injection risks.
- [CREDENTIALS_UNSAFE]: Provides instructions for handling sensitive information like Telegram bot tokens and API keys. It uses secure practices by directing the user to use environment variables or file paths rather than hardcoding credentials directly into the skill or commands.
Audit Metadata