crabbox
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of
crabbox,blacksmith, andpnpmCLI tools for remote task orchestration and local development workflows. These are used for running tests, managing remote leases, and inspecting system state. - [EXTERNAL_DOWNLOADS]: Instructions include installing the
crabboxCLI via homebrew (openclaw/tap/crabbox) and managing project dependencies using standard package managers likepnpm,npm, andyarn. - [CREDENTIALS_SAFE]: The skill explicitly advises against printing or hardcoding secrets. It promotes the use of environment variable forwarding (
--allow-env) and brokered authentication (crabbox login) to minimize the exposure of sensitive cloud credentials or API keys. - [DATA_EXPOSURE]: While the tool performs directory synchronization to remote environments (e.g., AWS, Blacksmith), this is the intended functionality of the orchestration service. The skill provides configuration options like
.crabboxignoreto manage what data is synced and recommends scrubbing unrelated environment variables.
Audit Metadata