clawsweeper
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands (
git,gh,pnpm) to manage repository state, trigger GitHub Actions workflows, and modify repository variables. These commands are consistent with the stated purpose of the skill and operate within the user's project directory. - [SAFE]: The skill explicitly defines security boundaries, instructing that workers should run with stripped secret environments and that mutation operations require deterministic gates or manual approval. It also provides guidance on routing sensitive security vulnerabilities to central handling rather than automated repair.
- [SAFE]: The 'Maintainer Mentions' feature processes GitHub comments to trigger actions. While this represents an indirect input surface, the skill specifies authorization checks for maintainers (OWNER, MEMBER, COLLABORATOR) and maps inputs to structured recommendations rather than executing arbitrary prose.
Audit Metadata