openclaw-local-mac-mini
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones the OpenClaw repository from a non-trusted GitHub source and performs installation of Node.js dependencies via npm.
- [COMMAND_EXECUTION]: Utilizes a wide range of shell commands for system configuration, including power management (
pmset), hostname settings (scutil), and firewall rules (socketfilterfw). It also creates a health check script and schedules it using cron. - [PRIVILEGE_ESCALATION]: Extensive use of
sudoto modify system-wide preferences, enable FileVault, and manage system services. The instructions specifically create a new system user (openclaw) with the-adminflag, granting it elevated privileges on the host machine. - [PERSISTENCE]: Configures multiple
launchdservices (com.openclaw.service.plist,com.openclaw.docker.plist) in/Library/LaunchDaemons/to ensure the agent and its Docker containers start automatically upon system boot and remain active. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the setup of an AI agent platform that ingests external data, representing a surface for indirect prompt injection.
- Ingestion points: The agent context in OpenClaw, which processes LLM interactions and data from the local environment.
- Boundary markers: None present in the setup instructions to delimit untrusted data.
- Capability inventory: The setup provides the agent with capabilities to execute Node.js scripts, interact with a Docker daemon, and write to the local filesystem.
- Sanitization: No specific input sanitization or output encoding mechanisms are described in the configuration.
Audit Metadata