openclawn-agent-framework
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the OpenClawn framework from a public GitHub repository (MuhammadHasbiAshshiddieqy/OpenClawn) and suggests standard Python package installation via pip and uv.
- [COMMAND_EXECUTION]: Provides tools for running Python code and shell commands (code_run, shell_run) within a sandboxed Docker environment to isolate the host system from potential malicious actions.
- [DATA_EXFILTRATION]: Includes network-enabled tools like web fetch and HTTP requests which incorporate built-in SSRF protections, such as blocking private IP ranges and cloud metadata endpoints.
- [CREDENTIALS_UNSAFE]: Adheres to secure secret management practices by instructing users to configure API keys for LLM providers using environment variables and .env files.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it can ingest untrusted data (web pages, PDFs) and perform powerful actions (file writes, code execution).
- Ingestion points: Web fetch, Web search, HTTP requests, and PDF extraction as described in SKILL.md.
- Boundary markers: Mentions injection guards for skill imports but lacks explicit delimiters for processing general untrusted tool outputs.
- Capability inventory: Includes Docker-based code and shell execution, filesystem writes, and Git operations.
- Sanitization: Uses Docker containerization for execution tools and SSRF filtering for network requests to limit the impact of potential injections.
Audit Metadata