clawhub-installer

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a third‑party GitHub repository used as an installer source that the script clones and then executes repository-provided install scripts (install-openclaw.sh), so while not obviously malicious it is a potential vector for arbitrary code execution unless the repo and commit are trusted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installer script (scripts/install-bioskills.sh) clones and verifies the remote repository https://github.com/GPTomics/bioSkills.git at runtime and then executes install-openclaw.sh from that fetched repository, which fetches and runs remote code (https://github.com/GPTomics/bioSkills.git).