openclaw-crabbox

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to interact with locally installed CLI tools (crabbox, blacksmith, and jq) to perform repository management, diagnostic checks, and test execution.
  • [REMOTE_CODE_EXECUTION]: The skill is designed to facilitate the execution of commands on remote providers, including AWS, Testbox (Blacksmith), and SSH targets. These operations are governed by detailed safety instructions that emphasize running code in isolated environments.
  • [SAFE]: The skill demonstrates a strong security posture by providing explicit recipes for handling untrusted code. This includes requirements for using fresh leases per commit SHA, disabling instance roles on AWS, checking for IMDSv2 404 responses to prevent credential harvesting, and strictly managing environment variable injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 10:59 AM