nemoclaw-contributor-onboard
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script
./scripts/dev-setup.shand various project-specific npm commands (npm run agent,npm run dev:doctor). These actions are secured by instructions requiring the agent to compare the local worktree againstorigin/mainand obtain explicit user authorization before executing modified code or making host-level changes. - [DATA_EXFILTRATION]: Instructions explicitly forbid the agent from printing or logging tokens, private keys, or credentials. It also mandates that secrets never be placed in command arguments or generated reports.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external files such as
CONTRIBUTING.mdandAGENTS.md. To mitigate potential injection risks from these sources, the skill designates the repository's setup script as the sole executable source of truth and requires manual approval for sensitive operations.
Audit Metadata