crabbox
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies extensively on executing shell commands to manage remote testing infrastructure. Examples include
crabbox warmup,crabbox run,pnpm crabbox:run, andblacksmith testbox listacross Linux, macOS, and Windows environments. - [EXTERNAL_DOWNLOADS]: The skill references downloading and installing tools from external sources, including
brew install openclaw/tap/crabboxand fetching pull request data from GitHub using the--fresh-prflag. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze external data sources, creating a potential surface for indirect prompt injection.
- Ingestion points: The agent is directed to read remote command outputs, JSON summaries (containing fields like
leaseIdandcommandPhases), remote logs, and VNC capture data inSKILL.md. - Boundary markers: No explicit boundary markers or "ignore instructions" delimiters are specified for the external data being processed.
- Capability inventory: The skill has access to extensive shell execution capabilities locally and on remote targets, including
sudooperations and network-based CLI tools mentioned inSKILL.md. - Sanitization: The skill includes instructions for manual redaction of secrets in logs, but no automated sanitization for the content processed by the LLM.
- [DYNAMIC_EXECUTION]: The skill utilizes features for dynamic script execution on remote hosts through the
--scriptand--script-stdinflags, which involve uploading and running local files or strings in a remote shell environment.
Audit Metadata