awesome-openclaw-usecases-zh
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone repositories from external sources, specifically GitHub and AtomGit repositories belonging to a user not recognized as a trusted organization.
- [DATA_EXFILTRATION]: The skill includes implementation examples for accessing highly sensitive local data, such as reading WeChat message history directly from a local SQLite database and extracting browser cookies for platform automation.
- [COMMAND_EXECUTION]: The skill documents the use of CLI tools and shell commands to perform operations like searching documents and sending messages, which involves interacting with system processes.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a multi-agent architecture that ingests untrusted data from various external platforms without providing robust sanitization or boundary markers in the example snippets.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: Untrusted data enters the agent context through platform-specific bots (Feishu, DingTalk), transcriptions of meeting recordings, and chat history extractions (found in SKILL.md).
- [INDIRECT_PROMPT_INJECTION]: Boundary markers: The provided code examples do not incorporate delimiters or instructions to ignore embedded commands within the external data.
- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill demonstrates capabilities for network requests (APIs), file system access (SQLite reading), and shell command execution (Lark CLI).
- [INDIRECT_PROMPT_INJECTION]: Sanitization: The reference code lacks explicit logic to sanitize or escape external content before it is interpolated into agent prompts.
Audit Metadata