openclaw-release-maintainer
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to source the user's local shell configuration file (
source "$HOME/.profile") to acquire sensitive environmental tokens, includingOPENAI_API_KEY,ANTHROPIC_API_KEY, and a Discord bot token. - [CREDENTIALS_UNSAFE]: Detailed instructions guide the agent to use the 1Password CLI (
op://protocol) to retrieve npm credentials and One-Time Passwords (OTP) for package publication. - [COMMAND_EXECUTION]: The skill performs extensive shell command execution, including running local TypeScript and Bash scripts (
scripts/package-mac-dist.sh,scripts/make_appcast.sh,scripts/openclaw-npm-postpublish-verify.ts) and build tools likepnpmandnodeto manage packaging, signing, and notarization. - [DATA_EXFILTRATION]: The skill is designed to transmit release artifacts and metadata to external platforms, including the npm registry, GitHub, Discord, and X (Twitter).
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted external data.
- Ingestion points: Git commit history and
CHANGELOG.mdare read to generate release notes. - Boundary markers: Absent; the agent extracts content based on markdown structure without explicit isolation of potentially malicious instructions.
- Capability inventory: The agent has permission to execute shell commands, modify project files (e.g.,
package.json, Apple.plistfiles), and perform network operations. - Sanitization: Absent; the instructions prioritize impact-based sorting but do not specify filtering for embedded instruction blocks in commit logs.
Audit Metadata