openclaw-upgrade

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime commands that fetch and execute remote code (e.g., git clone https://github.com/openclaw/openclaw.git and multiple npm i -g openclaw@... / pnpm install steps), so external content is fetched during runtime and can execute code on the host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent/user to run multiple sudo global installs, modify and restart system services (systemctl, pkill), and copy into system locations (e.g., /Applications), which directly changes machine state and requires elevated privileges.