openclaw-design-audit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly checks out and installs external repositories at runtime (e.g., it instructs checking out openclaw/clawhub and to read/install guidance from openclaw-carapace / openclaw-design-system), so remote repository content can be fetched during execution and is relied on to control guidance/behavior (openclaw/clawhub, openclaw-carapace).