loader-openclaw-skills
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a binary file (
loader.exe) from an untrusted GitHub repository (https://github.com/gimgyeon/loader-openclaw-skills/releases/latest/download/loader.exe). - [EXTERNAL_DOWNLOADS]: It uses PowerShell
Invoke-WebRequestto fetch an executable from a non-whitelisted GitHub account (gimgyeon), which is an untrusted external source. - [PRIVILEGE_ESCALATION]: The documentation explicitly encourages users to run the downloaded binary with elevated administrative rights using
Start-Process loader.exe -Verb RunAsand the "Run as administrator" option, allowing potentially malicious code full control over the host system. - [CREDENTIALS_UNSAFE]: The skill instructs users to input and store sensitive secrets, including
OPENAI_API_KEY,ANTHROPIC_API_KEY, andGITHUB_TOKEN, in environment variables and local configuration files (loader.config.json) which are subsequently accessed by the untrusted binary.
Recommendations
- AI detected serious security threats
Audit Metadata