openclaw
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands to restart the OpenClaw gateway. In 'scripts/openclaw_config.py', the 'restart_gateway' function attempts to run 'openclaw gateway restart', 'systemctl --user restart openclaw-gateway', and 'systemctl restart openclaw-gateway'. These commands are hardcoded in a list and are only invoked if the user provides the '--restart' flag in subcommands like 'copy', 'add-model', or 'switch'.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from OpenClaw configuration files ('openclaw.json') and model definition files, creating a surface for indirect instructions. \n
- Ingestion points: Data is loaded via 'load_config' in 'scripts/openclaw_config.py' and 'load_model_json' in 'scripts/add_model.py'.\n
- Boundary markers: No specific boundary markers or instructions to ignore embedded content are used when the agent processes the resulting configuration data.\n
- Capability inventory: The skill has the capability to write to the file system ('save_config', 'backup_config') and execute service restart commands ('restart_gateway').\n
- Sanitization: The skill relies on standard JSON parsing and validates the structural integrity of the configuration (e.g., checking for required fields like 'baseUrl' or 'api'), but does not sanitize text content for potential prompt injection patterns.
Audit Metadata