gh-issues
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It fetches external content (GitHub issue titles, bodies, and review comments) and interpolates them directly into prompts for sub-agents. These sub-agents have significant capabilities, including shell access and the ability to perform network operations, which could be abused if an attacker-controlled issue contains malicious instructions.
- [COMMAND_EXECUTION]: The orchestrator and sub-agents execute shell commands such as
git,curl, andjq. Additionally, the skill usesnode -eto dynamically execute inline JavaScript for parsing configuration files and extracting tokens. - [CREDENTIALS_UNSAFE]: The skill programmatically reads GitHub authentication tokens from local configuration files located at
~/.openclaw/openclaw.jsonand/data/.clawdbot/openclaw.json. While necessary for functionality, this pattern involves direct access to sensitive credential stores. - [EXTERNAL_DOWNLOADS]: The skill performs extensive network operations targeting the GitHub REST API (
api.github.com) to fetch issues, read reviews, and create pull requests.
Audit Metadata