voltagent-openclaw-skill-loader

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The URLs point to a workflow that requires downloading and running a Windows executable (loader.exe) from a small/low‑activity GitHub repo and a private registry (registry.clawhub.io) rather than an established vendor — direct .exe downloads from unverified/small GitHub releases and personal registries are high‑risk and could be used to distribute malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). At runtime, VoltAgent “downloads and installs OpenClaw skills from ClawHub registry” (public community registry) and then configures/launches them, so outsider-authored skill content (e.g., skill descriptions/prompts or other readable text shipped with those skills) can be ingested into the agent’s LLM context via the installed skills.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — loader.exe is described as pulling and installing skills at runtime from the ClawHub registry (settable via CLAWHUB_REGISTRY_URL, default https://registry.clawhub.io), which means remote code/content fetched from that URL is executed as required dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The loader explicitly downloads and installs software, configures environment variables and system directories, can auto-install OpenClaw, and even instructs running "as administrator" or using an elevated option and provides a "--no-security-check" bypass — all actions that modify system state and require/encourage elevated privileges.