openclaw-awd-arena
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches source code from an external repository (
https://github.com/LYiHub/OpenClaw-AWD-Arena.git) during the deployment process. - [REMOTE_CODE_EXECUTION]: Executes code from an external source through
docker-compose up --buildanddocker buildcommands. - [PRIVILEGE_ESCALATION]: Recommends mounting the Docker socket (
/var/run/docker.sock) into the referee container, which allows it to control the host system's Docker daemon. - [COMMAND_EXECUTION]: The agent's core loop involves executing dynamically generated commands from the LLM, which could result in arbitrary code execution within the agent's container.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the agent processes external service data and target machine information without sanitization or boundary delimiters.
- Ingestion points:
agent/main.py(viaget_target_infoandget_targets). - Boundary markers: Not used in the prompt templates.
- Capability inventory: High-risk command execution capabilities (
execute_commandsandexecute_exploits). - Sanitization: No evidence of validation or filtering for ingested data.
Audit Metadata