byted-security-clawsentry

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read secret tokens like loginToken from a state file and pass them directly as command-line arguments, creating an insecure credential handling pattern where secrets pass through the LLM context and output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The script bundle.js communicates with Volcano Engine domains (openclaw.sdk.access.llm-shield.omini-shield.com) at runtime to create login tokens and poll authentication status, constituting a common/reputable unofficial operational dependency.