openclaw-china-docker

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md Pattern 3 explicitly instructs initializing "Agent Reach" to search external social media and web sources (Twitter, Xiaohongshu, Weibo, Douyin), so the agent will fetch and interpret untrusted, user-generated third‑party content as part of its workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). Flagged because the skill explicitly fetches and runs required remote code at runtime (git clone https://github.com/justlovemaki/openclaw-china-docker.git and pulling/running the Docker image justlikemaki/openclaw-docker-cn-im:latest), so external content will be executed inside containers and thus directly controls runtime behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs privileged host-modifying actions (explicit "sudo chown" use, advises mounting /var/run/docker.sock for sandbox mode, and running docker-compose commands that alter containers/volumes), which can enable or require elevated privileges and can compromise the host state.