deepseek-openclaw-integration
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to clone a repository from an untrusted source (github.com/Chiptreevaluate/deepseek-openclaw-863.git). External repositories not associated with known trusted organizations can contain malicious payloads.
- [COMMAND_EXECUTION]: Instructions to run npm install and npm start on untrusted code allow for arbitrary code execution. npm install is particularly risky as it can execute hidden scripts during the dependency resolution phase.
- [METADATA_POISONING]: The troubleshooting section contains a 'Security Warning on Installation' that advises users to 'Temporarily pause protection during installation' if antivirus software blocks the process. This is a common social engineering tactic used to facilitate the installation of malware by bypassing host security controls.
Recommendations
- AI detected serious security threats
Audit Metadata