openclaw-pr-batch-sweep
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for repository maintenance and includes comprehensive security boundaries. In
references/worker-contract.md, the AI is explicitly instructed to treat all contributor-controlled content (PR bodies, patches, comments) as untrusted and to never follow instructions or commands found within that content. - [COMMAND_EXECUTION]: The skill utilizes helper scripts (
scripts/rank-candidates.mjsandscripts/hydrate-candidates.mjs) to automate PR processing. These scripts usespawnSyncto interact with the GitHub CLI (ghx). Analysis of these scripts shows robust input validation: PR numbers are cast to integers and repository names are validated via regular expressions, preventing shell injection vulnerabilities. - [PROMPT_INJECTION]: No malicious prompt injection patterns were detected. On the contrary, the skill implements 'Vision Wash' and 'Operator Selection' policies that act as high-level safety filters to exclude sensitive changes (auth, security, credentials) from being processed by the agent.
- [CREDENTIALS_SAFE]: No hardcoded credentials or sensitive tokens were found. The skill relies on environment variables for tool paths and standard API interaction via
ghx. - [DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network activity is confined to standard GitHub operations via authenticated CLI tools.
Audit Metadata