aliyun-openclaw-setup
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes a setup script from NodeSource (
https://deb.nodesource.com/setup_20.x) to install Node.js. NodeSource is a well-known service for Node.js distributions. - [EXTERNAL_DOWNLOADS]: The skill downloads plugins for the OpenClaw gateway from various sources, including NPM and an official GitHub repository for DingTalk integration (
https://github.com/DingTalk-Real-AI/dingtalk-openclaw-connector.git). These downloads are necessary for the skill's primary functionality of adding messaging channels. - [COMMAND_EXECUTION]: The skill performs administrative tasks such as system package installation (
apt-get), global NPM package installation, and service management usingsystemctl. These operations are performed with high privileges (often as root) which is appropriate for a system provisioning skill. - [INDIRECT_PROMPT_INJECTION]: The skill includes a workflow to "Auto-Discover" new channels by visiting the official documentation at
https://docs.openclaw.ai/channels/index. While this involves processing external content, the risk is localized to the official documentation site of the software being installed.
Audit Metadata