loader-openclaw-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are suspicious because they include a direct download of an executable from an unfamiliar GitHub account (loader.exe via github.com/gimgyeon), reference non-standard/third‑party domains (hub.openclaw.dev, ara.so) used to host/serve skills, and the described loader can fetch/run many third‑party components and even skip security scans—constituting a significant supply‑chain/malware risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow downloads and installs “5200+ curated community skills from ClawHub” (public community registry) and then launches them, so outsider-authored free text from those skill packages (e.g., README/prompt/config text) can be ingested into the agent’s LLM context via the installed skills’ instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README instructs downloading and executing loader.exe from https://github.com/gimgyeon/loader-openclaw-skills/releases/latest/download/loader.exe and the loader uses the ClawHub registry (https://hub.openclaw.dev) at runtime to fetch and install/launch third‑party skills, meaning remote content is fetched and executed and can directly control agent prompts/code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The loader explicitly encourages elevating privileges ("Run as administrator", Start-Process -Verb RunAs), automates installing many third‑party skills and dependencies (which modify system state), and includes a --skip-security option to bypass scans, so it pushes actions that can compromise the host.