openclaw-secret-scanning-maintainer
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) to automate secret redaction and alert resolution. It follows security best practices by using argument arrays inspawnSyncand the-F body=@filesyntax, which prevents shell command injection when handling potentially large or complex text bodies. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection. Because the agent is instructed to read and process untrusted content (issue, PR, and comment bodies) to identify secrets, an attacker could embed malicious instructions within that content to influence the agent's behavior.
- Ingestion points: The
fetch-contentfunction inscripts/secret-scanning.mjsretrieves external content via the GitHub API and saves it to temporary files for agent processing. - Boundary markers: None. The instructions direct the agent to read the raw content of the body files without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The script provides tools for redacting bodies, deleting/recreating comments, and resolving security alerts in the repository.
- Sanitization: While the script ensures secure shell interactions, it does not provide mechanisms to sanitize or validate the content against secondary prompt injection before the LLM processes it.
Audit Metadata