nemoclaw-maintainer-e2e

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh), Git, and Python for workflow management. It generates correlation IDs via python3 -c 'import uuid; print(uuid.uuid4())' and executes a local validation script using node --experimental-strip-types.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the NVIDIA/NemoClaw repository on GitHub to dispatch workflows, check statuses, and download test evidence artifacts. These operations target the official organization repository.
  • [SAFE]: The included validation script validate-full-e2e-evidence.mts implements rigorous security checks on the data fetched from GitHub. It verifies commit SHAs, confirms workflow conclusions, and enforces that URLs originate from the trusted NVIDIA/NemoClaw Actions domain. The skill follows least-privilege principles by requiring maintainer/admin permissions for sensitive paths and using specific correlation IDs for tracking.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 12:36 AM
Security Audit — agent-trust-hub — nemoclaw-maintainer-e2e