SR
SkillRadar
Agent security + benchmarks
Menu
Trust Report v1

clawsweeper

Use for all ClawSweeper work: OpenClaw issue/PR sweep reports, commit-review reports, repair jobs, cloud fix PRs, @clawsweeper maintainer mention commands, trusted ClawSweeper-reviewed autofix/automerge, GitHub Actions monitoring, permissions, gates, and manual backfills.

Overall
72
Trust
49
Utility
88
Momentum
95

Install caution

High-risk behavior present

Risk: High

Source: OpenClaw Built-in Skills

Path: .agents/skills/clawsweeper/SKILL.md

Review flags: credential or secret references, filesystem/home-directory access, shell command snippets. These are review signals, not definitive security judgments; inspect before installing.

Required permissions

  • Environment variables / secrets
  • Shell commands
  • Filesystem/home access

Permissions are inferred from SKILL.md text only. They are review prompts, not guarantees about runtime behavior.

Risk flags explained

credential_or_secret_referencehigh

Mentions tokens, API keys, passwords, or private-key style environment variables.

filesystem_write_or_home_accessmedium

Mentions filesystem writes, deletes, home-directory paths, or config/key locations.

shell_commandmedium

Contains shell command snippets. Review commands before copy/paste or agent execution.

Score explanation

Trust

  • Trust starts at 90 before review-signal penalties and metadata bonuses.
  • Risk-signal penalty: -43 from 3 detected flag(s).
  • Metadata bonus: +2 from author/version/description fields.

Utility

  • Utility starts at 55 and rewards clear descriptions, runnable examples, and explicit setup needs.
  • Description present: yes.
  • Command examples detected: 25.
  • Environment variables detected: 1.

Momentum

  • Momentum starts at 45 and uses public repo activity signals.
  • Recent commit activity: latest repo update was 0 day(s) ago.
  • Recent commit volume: 100 commit(s) in the lookback window (+20).
  • Source has strong public adoption: 368598 stars.
  • Fork activity suggests reuse: 75946 forks.

Overall

  • Overall score weights trust 45%, utility 35%, and momentum 20%.

Detected signals

Env vars

  • CLAWSWEEPER_APP_PRIVATE_KEY

Commands

  • gh api "repos/openclaw/openclaw/commits/<sha>/check-runs?per_page=100" --jq '.check_runs[] | select(.name=="ClawSweeper Commit Review") | [.status,.conclusion,.details_url] | @tsv'
  • gh run list --repo openclaw/clawsweeper --workflow "ClawSweeper Commit Review" --limit 12 --json databaseId,displayTitle,event,status,conclusion,createdAt,updatedAt,url
  • gh run list --repo openclaw/clawsweeper --workflow "repair cluster worker" --limit 12 --json databaseId,displayTitle,event,status,conclusion,createdAt,updatedAt,url
  • gh run list --repo openclaw/clawsweeper --workflow "repair comment router" --limit 12 --json databaseId,displayTitle,event,status,conclusion,createdAt,updatedAt,url
  • gh run list --repo openclaw/openclaw --workflow "ClawSweeper Dispatch" --event push --limit 8 --json databaseId,displayTitle,event,status,conclusion,headSha,url
  • gh variable set CLAWSWEEPER_ALLOW_AUTOMERGE --repo openclaw/clawsweeper --body 1
  • gh variable set CLAWSWEEPER_ALLOW_EXECUTE --repo openclaw/clawsweeper --body 1
  • gh variable set CLAWSWEEPER_ALLOW_FIX_PR --repo openclaw/clawsweeper --body 1
  • gh variable set CLAWSWEEPER_ALLOW_MERGE --repo openclaw/clawsweeper --body 1
  • gh workflow run commit-review.yml --repo openclaw/clawsweeper -f target_repo=openclaw/openclaw -f commit_sha=<end-sha> -f before_sha=<start-or-parent-sha> -f create_checks=false -f enabled=true
  • git pull --ff-only
  • git status --short --branch

URLs

None detected in SKILL.md text scan.

Watch this skill

Get alerted when this skill adds credential requirements, shell commands, external domains, remote installer patterns, or risk-level changes.

Join watchlist beta

Methodology note

SkillRadar scans SKILL.md as hostile text only. It does not execute commands, install packages, or load third-party skills.