even-g2-bridge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider free text is the G2 user’s transcribed voice message (from the Even Realities G2 app) which the worker reads from body.messages[].content and forwards into the LLM context via callGateway() (and also directClaude() fallback), so the runtime LLM input can contain arbitrary outsider-authored text.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt instructs modifying the OpenClaw host configuration (enabling an HTTP endpoint and restarting the gateway) and installing global packages (npm -g wrangler), actions that change system service state and may require elevated privileges, so it pushes the agent/operator to perform state-changing operations on the host.