higress-openclaw-integration
Fail
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads a shell script from 'https://higress.ai/ai-gateway/install.sh' and executes it locally using './get-ai-gateway.sh' to deploy the gateway system.
- [CREDENTIALS_UNSAFE]: Deployment instructions recommend passing sensitive API keys (e.g., for OpenAI, Claude, DeepSeek) as plaintext command-line arguments to the installation script, which can expose them in shell history or process monitoring tools.
- [COMMAND_EXECUTION]: The skill performs multiple system operations including directory creation ('mkdir'), permission modification ('chmod'), and local script execution to facilitate the installation and plugin setup.
- [EXTERNAL_DOWNLOADS]: The skill uses 'curl' to fetch an external deployment script from the vendor's official site during the setup process.
Recommendations
- HIGH: Downloads and executes remote code from: https://higress.ai/ai-gateway/install.sh - DO NOT USE without thorough review
Audit Metadata