the-forge
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The shell script 'the-forge.sh' executes the primary logic via a local Python script ('forge.py') and uses inline Python commands to parse local configuration files.
- [DATA_EXFILTRATION]: The skill accesses the OpenRouter API key from '~/.openclaw/openclaw.json' and reads the user's voice profile from the 'clawd' workspace. This information is transmitted to 'https://openrouter.ai' to perform content generation tasks, which is the core purpose of the skill.
- [PROMPT_INJECTION]: The skill processes external trend data and community signals (Ingestion points: pattern_report_file, briefing_file). It uses markdown headers as boundary markers but does not implement strict sanitization or 'ignore instructions' delimiters for the ingested content. While the skill possesses network and local execution capabilities, no malicious intent was found in the handling of these data sources.
Audit Metadata