openclaw-windows-node

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally exposes remote-control/backdoor-style capabilities (remote RPC via WebSocket, including system.run), and implements explicit data-exfiltration primitives (screen snapshot, camera snap, STT transcription returning base64/text) plus registry protocol registration and storage/usage of bearer/API keys — enabling straightforward abuse if paired to an untrusted gateway.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly enables a "Node Mode" that exposes the Windows host as a controllable node including a "system.run" capability, camera/microphone and screen capture, and registry protocol registration/auto-update/install functionality — all of which allow an agent to execute commands and modify the machine's state and therefore pose high risk.