pull-skills
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill triggers the execution of local utility scripts, specifically
sync-goatedskills-to-openclaw-skills.sh,distribute-skills.sh, andbuild-skill-index.py, which are located in the user's workspace directory. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading content from the
itsAR-VR/goatedskillsrepository on GitHub. This is the primary source for the skills being synchronized to the local machine. - [DATA_EXPOSURE_AND_EXFILTRATION]: The instructions involve reading and writing files across multiple hidden directories in the home folder, including
~/.openclaw,~/.claude,~/.codex, and~/.agents, as part of its multi-tool synchronization logic.
Audit Metadata