hiclaw-collaborative-agent-os

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several links point to direct installer scripts (https://higress.ai/hiclaw/install.sh, https://higress.ai/hiclaw/install.ps1 and raw.githubusercontent.com install scripts) and the prompt includes curl|bash and iex patterns — running remote .sh/.ps1 directly is an inherently high-risk distribution vector even though many other links (GitHub repos, higress.io, discord, skills.sh, api.openai.com) appear legitimate.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime workflow ingests free-form text from Matrix room messages (user/participants) into the Manager/Workers’ LLM context; since those messages can be authored by non-operating users, this creates an indirect prompt-injection path from outsider-authored chat content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes installation/upgrade/uninstall commands that fetch and execute remote scripts at runtime (e.g., bash <(curl -sSL https://higress.ai/hiclaw/install.sh) and bash <(curl -fsSL https://raw.githubusercontent.com/higress-group/hiclaw/main/install/hiclaw-install.sh), and a PowerShell DownloadString from https://higress.ai/hiclaw/install.ps1), which clearly execute remote code and are required for setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs the agent/user to run installers (curl | bash), helm/kubectl/ docker commands that modify the host/cluster state and create resources including "Human" accounts and CLI-invited users, so it actively guides changes to the machine/cluster state and thus should be flagged.