openclaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill exposes the agent to untrusted third‑party content because its CLI and docs explicitly allow browsing arbitrary URLs (references/cli-full.md: "openclaw browser open "), running OpenProse programs from a path or URL (references/advanced-tools.md: "/prose run [path|url]"), and ingesting messages from external channels like WhatsApp/Telegram/Discord (references/cli-full.md and nodes-platforms.md), all of which the agent is expected to read and can materially influence subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs installing services and managing system daemons, Docker, and cron (and even tells users to "Use sudo for global installs"), so it directs actions that modify system-wide state and require elevated privileges.