alignfirst-developer-openclaw-playbook
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted data from multiple sources. This includes chat messages from Slack and Discord, external project files like READMEs and .plans/ directories, and pull request metadata retrieved from GitHub or GitLab.
- Ingestion points: User input is triaged in references/channel-handling.md; repository files are accessed during onboarding in references/runbooks/project-lifecycle.md; and PR/MR metadata is retrieved in references/working-session.md.
- Capability inventory: The agent has access to the exec tool, allowing it to run shell commands, project build tools, and the alcode coding agent.
- Boundary markers: The skill instructions do not specify strict delimiters or escaping when interpolating untrusted content into prompts, though it does encourage rephrasing tasks in the agent's own words.
- Sanitization: There is no evidence of formal sanitization for data extracted from external repositories or code-hosting platforms.
- [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary commands by instructing the agent to follow build and installation procedures defined in untrusted external sources.
- Evidence: The repository onboarding flow in references/runbooks/project-lifecycle.md explicitly directs the agent to "Install dependencies and build, following the repository's own README."
- Risk context: While this behavior is central to the skill's role as an autonomous developer, it allows external repository content to dictate command execution on the host system.
Audit Metadata