openclaw-android-setup
Fail
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to execute the command
curl -sL myopenclawhub.com/install | bash. This is a high-risk pattern that fetches an installer script from an external domain and pipes it directly into the shell for execution. This grants the remote server full control over the Termux environment and allows for the execution of arbitrary, unverified code. - [EXTERNAL_DOWNLOADS]: The installation process and subsequent update commands (
oa --update) download binary components, including a glibc dynamic linker and Node.js binaries, frommyopenclawhub.com. This domain is not recognized as a trusted organization or well-known service provider, posing a significant supply chain risk if the site or the binaries it hosts are compromised. - [COMMAND_EXECUTION]: The skill implements a custom management tool (
oa) and various core commands that perform extensive system modifications, including background process management, path conversion, and environment variable setup, based on instructions and files retrieved from remote sources.
Recommendations
- AI detected serious security threats
Audit Metadata