release-openclaw-maintainer
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests external, untrusted data to generate changelogs and release notes.
- Ingestion points: The skill reads git commit history (
git log) and pull request metadata (gh api) from the OpenClaw repository. - Boundary markers: There are no explicit instructions for the model to ignore embedded commands within the ingested data, although the skill enforces a strict output format.
- Capability inventory: The skill possesses extensive capabilities, including shell command execution (
pnpm,git,gh), file modifications, and GitHub Actions dispatching. - Sanitization: The instructions require a human maintainer to review and edit the generated changelog before it is committed, providing a layer of human-in-the-loop sanitization.
- [COMMAND_EXECUTION]: The skill executes a wide range of shell commands to manage the release lifecycle. While these are necessary for its intended purpose, they provide a large attack surface if the agent is manipulated via prompt injection.
- [CREDENTIALS_UNSAFE]: The skill manages sensitive credentials for NPM and API keys through private documentation and context variables (
$release-private). It follows security best practices by instructing the agent to usetmuxand avoid printing secrets to the terminal transcript to prevent accidental exposure.
Audit Metadata