hiclaw-multi-agent-orchestration

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These links include remote installer scripts explicitly intended to be executed (https://higress.ai/hiclaw/install.sh and install.ps1) — a high‑risk "curl|bash" / remote PowerShell pattern from domains that are not widely known, alongside third‑party registries (skills.sh, ara.so) and external APIs of unclear reputation; although several listed URLs are local/internal endpoints and an apparent helm repo (higress.io), the presence of downloadable/executable scripts from non‑well‑trusted hosts makes this a suspicious download source.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via Matrix room messages: the runtime coordinates Manager/Workers with humans in Matrix rooms, so any non-user-authored chat content (e.g., other participants’ messages) can be ingested as readable text by the agents at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Docker/upgrade install commands (bash <(curl -sSL https://higress.ai/hiclaw/install.sh) and the PowerShell iex of https://higress.ai/hiclaw/install.ps1) download and execute remote scripts at runtime, so they are runtime external dependencies that execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs executing remote install scripts (curl | bash / PowerShell remote execution), running helm/kubectl/docker commands that create or modify cluster and container resources, and even registering/resetting Matrix admin users—actions that change system state and may require elevated privileges, so it pushes the agent to compromise the host/cluster state.