skills/steipete/clawdhub/autoreview/Gen Agent Trust Hub

autoreview

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates the execution of external binaries such as Git, TruffleHog, and CLI interfaces for LLM engines including Codex, Claude Code, and Pi.
  • [COMMAND_EXECUTION]: The --parallel-tests feature enables the execution of user-defined test commands within a temporary, isolated workspace.
  • [CREDENTIALS_UNSAFE]: Test fixtures in the tests/fixtures/ directory contain hardcoded mock API keys and tokens designed to validate the efficacy of the integrated secret scanner.
  • [DATA_EXFILTRATION]: The skill includes functionality to stage credentials for remote delegation during testing when the OPENCLAW_TESTBOX environment variable is set; this is an intended feature for trusted maintainers.
  • [PROMPT_INJECTION]: The instructions provide a scope governor and contract that ensure the agent treats review output as advisory and manually verifies findings to mitigate risks from indirect prompt injection in analyzed code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 08:25 PM
Security Audit — agent-trust-hub — autoreview