openclaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the skill's required workflow instructs connecting a browser sidecar that performs web scraping and (optionally) script evaluation (references/browser-automation.md) and integrates with public messaging platforms (references/channels.md), so the agent will fetch and interpret untrusted public web pages and user-generated messages that can materially influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs runtime fetching and execution of remote code (docker images like coollabsio/openclaw:latest and coollabsio/openclaw-browser:latest, and an installation path that runs "git clone https://github.com/coollabsio/openclaw.git" followed by ./docker-setup.sh), which means these external resources are fetched during runtime and will execute remote code—thus they are risky.