openclaw

No direct malware is demonstrated because the input is documentation rather than source or installer code. However, the installation instructions present meaningful supply-chain and execution risks: they execute unpinned remote scripts, install the mutable latest npm release globally, and encourage loading third-party skills that may run with extensive local permissions. The actual security posture requires review of the installer scripts, package contents, skill-validation mechanisms, permissions, and integrity controls before use.