openclaw-crabbox
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to resolve critical execution placeholders, such as and , from external repository files like AGENTS.md. This creates a vulnerability where malicious content in a repository could lead to unauthorized command execution.
- Ingestion points: External files (e.g., AGENTS.md, .crabbox.yaml) and repository metadata.
- Boundary markers: The skill does not define clear delimiters or "ignore" instructions for the content retrieved from these external files.
- Capability inventory: The skill has the ability to execute arbitrary shell commands via crabbox run, ssh, and docker, and can execute scripts via the --script flag.
- Sanitization: No explicit sanitization or validation of the resolved commands is defined before execution.
- [COMMAND_EXECUTION]: The skill routinely executes shell commands using the crabbox CLI, where the specific logic is dynamically determined by external configuration strings.
- [DYNAMIC_EXECUTION]: The skill facilitates the execution of scripts provided via the --script and --script-stdin flags, which are populated based on external repository instructions provided during the task.
Audit Metadata