openclaw-ghsa-maintainer
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard command-line tools including
gh(GitHub CLI),npm,jq, andrg(ripgrep) to perform repository maintenance tasks. These tools are used for their intended purposes within the OpenClaw repository context. - [DATA_EXPOSURE]: The skill interacts with the GitHub Security Advisories API. It specifically targets the
openclaw/openclawrepository. It includes a security-conscious practice of usingmktempfor the npmuserconfigflag to avoid reading potentially sensitive local configuration files during version checks. - [PROMPT_INJECTION]: The instructions reinforce security protocols, requiring the agent to read
SECURITY.mdand seek explicit permission before performing sensitive actions like publishing an advisory. No bypass or override patterns were detected. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (GitHub API and npm registry). The risk is mitigated by the use of
jqfor parsing and constructing JSON payloads, rather than unsafe shell string interpolation, which prevents common injection vulnerabilities during the PATCH process.
Audit Metadata