skills/steipete/openclaw/trello/Gen Agent Trust Hub

trello

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands involving curl and jq to interact with the Trello REST API. The commands facilitate listing boards, lists, and cards, as well as creating or modifying Trello resources. The jq utility is used for JSON processing of API responses.
  • [EXTERNAL_DOWNLOADS]: Includes a metadata configuration to install the jq utility via the Homebrew package manager during the setup phase.
  • [DATA_EXFILTRATION]: Uses TRELLO_API_KEY and TRELLO_TOKEN environment variables for authentication. These credentials are transmitted to api.trello.com, which is the official endpoint for the Trello service.
  • [PROMPT_INJECTION]: Potential surface for indirect prompt injection from data retrieved from external sources.
  • Ingestion points: Reads card names, descriptions, and comments from Trello boards as documented in the command examples.
  • Boundary markers: No delimiters or specific instructions are provided to the agent to distinguish Trello content from system instructions.
  • Capability inventory: The skill provides capabilities to both read from and write to Trello via its REST API.
  • Sanitization: Retrieved content is filtered through jq but not specifically sanitized or escaped to prevent embedded instructions from potentially influencing agent behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 02:11 PM
Security Audit — agent-trust-hub — trello