openclaw-qa-testing
Fail
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides detailed instructions for retrieving secrets using the
op(1Password) CLI. It specifies vault names (e.g., 'OpenClaw', 'Private') and item names (e.g., 'Telegram E2E', 'OPENCLAW_QA_CONVEX_SITE_URL', 'Convex') to be used during testing operations. - [COMMAND_EXECUTION]: The skill makes extensive use of the
pnpmcommand to execute local testing scripts and theghCLI to trigger remote GitHub Actions workflows. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes transcripts and live data from external chat platforms (WhatsApp, Telegram) during 'character evals' and QA scenarios. Malicious content within these chat channels could potentially influence agent behavior when analyzing test results.
- Ingestion points: Processes scenario markdown files in
qa/scenarios/, live WhatsApp/Telegram messages, and transcripts from OpenAI model evaluations. - Boundary markers: No explicit instruction delimiters or 'ignore embedded instructions' warnings are provided for the data being processed.
- Capability inventory: The agent has access to
pnpmfor shell execution,ghfor remote workflow dispatch, andopfor credential retrieval. - Sanitization: No sanitization or validation of the ingested transcript data is mentioned.
Recommendations
- AI detected serious security threats
Audit Metadata