openclaw
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Extensive use of shell commands for Docker container management and configuration. Evidence includes docker run, docker compose, and openclaw CLI usage.
- [EXTERNAL_DOWNLOADS]: Fetches setup scripts and GPG keys from well-known infrastructure providers. Evidence includes downloads from nodesource.com and docker.com.
- [REMOTE_CODE_EXECUTION]: Uses a common installation pattern where a remote setup script is piped to a shell. Evidence includes the NodeSource installation command curl -fsSL https://deb.nodesource.com/setup_22.x | bash -.
- [PROMPT_INJECTION]: The skill configures an AI gateway that ingests untrusted data from various messaging platforms, creating a surface for indirect prompt injection. Ingestion points: Messaging channels like Telegram, Discord, and Slack (as seen in references/channels.md). Boundary markers: No explicit instructions for implementing delimiters to separate external messages from system prompts. Capability inventory: The tool has access to LLM APIs and browser automation capabilities. Sanitization: The instructions do not detail sanitization or filtering of incoming messages.
Audit Metadata