openclaw-beam
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits local session transcripts to an external endpoint (
BEAM_ENDPOINT) configured by the user. While it performs aggressive local sanitization inscripts/beam-session.jsto redact API keys, private keys, and local paths before transmission, the core functionality involves outbound data transfer of developer activity logs.\n- [COMMAND_EXECUTION]: Thescripts/beamutility executes thecloudflaredCLI tool to facilitate authentication for Cloudflare Access protected endpoints. This is a standard procedure for obtaining tokens for secured services but involves the execution of local binaries based on the endpoint origin.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes session logs which are considered untrusted data and could contain embedded instructions. The skill implements a robust defense-in-depth approach to mitigate this risk.\n - Ingestion points: Reads
.jsonltranscript files from the local filesystem during the resolution process (scripts/beam-session.js).\n - Boundary markers: The
SKILL.mdinstructions establish a strict contract for data boundaries, and the sanitizer uses specific markers to denote redacted content.\n - Capability inventory: The skill possesses capabilities for network egress (
fetch), local file reading (fs), and process execution (execFileSync).\n - Sanitization: Employs multi-layered regex-based redaction and a secondary validation step (
unsafePatterns) to ensure sensitive information does not remain in the output.
Audit Metadata