nemoclaw-maintainer-pr-comparator
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the official gh CLI for all repository interactions. No unauthorized network access or sensitive file operations were detected. All external communication is directed to well-known GitHub domains.
- [COMMAND_EXECUTION]: The skill executes local scripts (scripts/find-candidates.sh, scripts/collect-gates.sh, scripts/parse-supersession.sh, scripts/render-verdict.py) to perform analysis. These scripts are authored by NVIDIA and handle GitHub metadata securely using jq for parsing.
- [PROMPT_INJECTION]: The skill ingests untrusted content from GitHub issues and PR descriptions to perform analysis. [Ingestion points]: gh issue view and gh pr view in SKILL.md, scripts/find-candidates.sh, and scripts/parse-supersession.sh. [Boundary markers]: Absent. [Capability inventory]: Shell script execution (gh CLI), Python script execution, and scorecard generation. [Sanitization]: Content is parsed via jq to ensure valid structure, but textual content is not filtered for LLM instructions. The risk of indirect prompt injection is mitigated by the structured multi-tier analysis and the requirement for maintainer oversight of the generated scorecard.
Audit Metadata