openclaw-maintainer
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands for git operations, GitHub CLI (
gh), and package management (pnpm). These includegit worktree,git rebase,gh pr merge, andpnpm install/test/buildwithin the context of a local development environment (~/Development/openclaw). - [EXTERNAL_DOWNLOADS]: The skill uses
pnpm installandgit fetchto download dependencies and repository updates from official registries and the configured GitHub remote. These are standard development operations for the intended purpose of the skill. - [DATA_EXPOSURE]: The skill reads GitHub metadata, PR diffs, and local review artifacts (
.local/*.md) to coordinate work between subagents. This data is handled locally within the specified worktree environment. - [PRIVILEGE_ESCALATION]: The skill enforces a strict 'no push to main' policy, requiring all code changes to be merged via
gh pr merge --squashafter passing automated gates (lint, build, tests). It also implements identity-aware commenting to prevent the agent from interacting with its own contributions inappropriately.
Audit Metadata