loader-openclaw-skills
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download a binary file (
loader.exe) from a personal GitHub repository (github.com/gimgyeon/loader-openclaw-skills) that does not belong to a trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: The skill provides numerous commands to execute the downloaded binary (
loader.exe). Executing untrusted binaries allows for arbitrary code execution on the user's system. - [COMMAND_EXECUTION]: The skill explicitly recommends running the binary with administrative privileges using the PowerShell
Start-Process loader.exe -Verb RunAscommand, which grants the untrusted code full control over the operating system. - [CREDENTIALS_UNSAFE]: The instructions prompt the user to set sensitive environment variables, including
OPENAI_API_KEY,ANTHROPIC_API_KEY, andGITHUB_TOKEN. These credentials are then accessible by the downloaded third-party binary, creating a high risk of credential theft.
Recommendations
- AI detected serious security threats
Audit Metadata