openclaw-release-maintainer

Warn

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill instructs the agent to source the user's local shell configuration file (source "$HOME/.profile") to acquire sensitive environmental tokens, including OPENAI_API_KEY, ANTHROPIC_API_KEY, and a Discord bot token.
  • [CREDENTIALS_UNSAFE]: Detailed instructions guide the agent to use the 1Password CLI (op:// protocol) to retrieve npm credentials and One-Time Passwords (OTP) for package publication.
  • [COMMAND_EXECUTION]: The skill performs extensive shell command execution, including running local TypeScript and Bash scripts (scripts/package-mac-dist.sh, scripts/make_appcast.sh, scripts/openclaw-npm-postpublish-verify.ts) and build tools like pnpm and node to manage packaging, signing, and notarization.
  • [DATA_EXFILTRATION]: The skill is designed to transmit release artifacts and metadata to external platforms, including the npm registry, GitHub, Discord, and X (Twitter).
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted external data.
  • Ingestion points: Git commit history and CHANGELOG.md are read to generate release notes.
  • Boundary markers: Absent; the agent extracts content based on markdown structure without explicit isolation of potentially malicious instructions.
  • Capability inventory: The agent has permission to execute shell commands, modify project files (e.g., package.json, Apple .plist files), and perform network operations.
  • Sanitization: Absent; the instructions prioritize impact-based sorting but do not specify filtering for embedded instruction blocks in commit logs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 13, 2026, 02:11 PM
Security Audit — agent-trust-hub — openclaw-release-maintainer