skills/steipete/peekaboo/crabbox/Gen Agent Trust Hub

crabbox

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of crabbox, blacksmith, and pnpm CLI tools for remote task orchestration and local development workflows. These are used for running tests, managing remote leases, and inspecting system state.
  • [EXTERNAL_DOWNLOADS]: Instructions include installing the crabbox CLI via homebrew (openclaw/tap/crabbox) and managing project dependencies using standard package managers like pnpm, npm, and yarn.
  • [CREDENTIALS_SAFE]: The skill explicitly advises against printing or hardcoding secrets. It promotes the use of environment variable forwarding (--allow-env) and brokered authentication (crabbox login) to minimize the exposure of sensitive cloud credentials or API keys.
  • [DATA_EXPOSURE]: While the tool performs directory synchronization to remote environments (e.g., AWS, Blacksmith), this is the intended functionality of the orchestration service. The skill provides configuration options like .crabboxignore to manage what data is synced and recommends scrubbing unrelated environment variables.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 02:18 PM
Security Audit — agent-trust-hub — crabbox