nemoclaw-maintainer-e2e
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh), Git, and Python for workflow management. It generates correlation IDs viapython3 -c 'import uuid; print(uuid.uuid4())'and executes a local validation script usingnode --experimental-strip-types. - [EXTERNAL_DOWNLOADS]: The skill interacts with the
NVIDIA/NemoClawrepository on GitHub to dispatch workflows, check statuses, and download test evidence artifacts. These operations target the official organization repository. - [SAFE]: The included validation script
validate-full-e2e-evidence.mtsimplements rigorous security checks on the data fetched from GitHub. It verifies commit SHAs, confirms workflow conclusions, and enforces that URLs originate from the trustedNVIDIA/NemoClawActions domain. The skill follows least-privilege principles by requiring maintainer/admin permissions for sensitive paths and using specific correlation IDs for tracking.
Audit Metadata