autoreview
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates the execution of external binaries such as Git, TruffleHog, and CLI interfaces for LLM engines including Codex, Claude Code, and Pi.
- [COMMAND_EXECUTION]: The
--parallel-testsfeature enables the execution of user-defined test commands within a temporary, isolated workspace. - [CREDENTIALS_UNSAFE]: Test fixtures in the
tests/fixtures/directory contain hardcoded mock API keys and tokens designed to validate the efficacy of the integrated secret scanner. - [DATA_EXFILTRATION]: The skill includes functionality to stage credentials for remote delegation during testing when the
OPENCLAW_TESTBOXenvironment variable is set; this is an intended feature for trusted maintainers. - [PROMPT_INJECTION]: The instructions provide a scope governor and contract that ensure the agent treats review output as advisory and manually verifies findings to mitigate risks from indirect prompt injection in analyzed code.
Audit Metadata