skills/montagao/skills/ouraclaw/Gen Agent Trust Hub

ouraclaw

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to download the ouraclaw repository from the author's GitHub account (github.com/montagao/ouraclaw) and install its dependencies using bun install if the tool is not already present on the system.
  • [COMMAND_EXECUTION]: The skill uses shell commands to manage the tool installation (git clone, bun install, bun link) and to retrieve sleep data (ouraclaw score, ouraclaw sleep).
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes health metrics from the Oura Ring API, creating a potential surface for indirect instructions if the source data were maliciously crafted.
  • Ingestion points: Standard output from the ouraclaw CLI tool in SKILL.md.
  • Boundary markers: None identified in the prompt instructions.
  • Capability inventory: Shell command execution, local file system access for repository cloning, and dependency installation.
  • Sanitization: No specific filtering or sanitization of the CLI output is defined.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:25 AM