nemoclaw-contributor-onboard

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local shell script ./scripts/dev-setup.sh and various project-specific npm commands (npm run agent, npm run dev:doctor). These actions are secured by instructions requiring the agent to compare the local worktree against origin/main and obtain explicit user authorization before executing modified code or making host-level changes.
  • [DATA_EXFILTRATION]: Instructions explicitly forbid the agent from printing or logging tokens, private keys, or credentials. It also mandates that secrets never be placed in command arguments or generated reports.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external files such as CONTRIBUTING.md and AGENTS.md. To mitigate potential injection risks from these sources, the skill designates the repository's setup script as the sole executable source of truth and requires manual approval for sensitive operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:15 AM
Security Audit — agent-trust-hub — nemoclaw-contributor-onboard