openclaw-china-integration
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to run
npx @openclaw-china/setup. The use ofnpxdownloads and executes a package from the npm registry at runtime, which constitutes remote code execution from a source outside of the trusted organization list. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple external dependencies from the
@openclaw-chinanamespace, including@openclaw-china/dingtalk,@openclaw-china/qqbot,@openclaw-china/wecom,@openclaw-china/wecom-app,@openclaw-china/wecom-kf, and@openclaw-china/wechat-mp. These packages are external to the skill and the platform's trusted vendors. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an integration where the agent processes messages, files, and voice recognition text directly from external messaging platforms. This creates a vulnerability surface where an external user could send a message containing instructions to override the agent's behavior.
- Ingestion points: Message content from DingTalk, QQ, and WeChat channels (
message.content); recognized text from voice messages (voiceMessage.recognizedText); and media file buffers (wecomApp.downloadMedia). - Boundary markers: None. The provided examples show the raw content being passed directly to
openclawAgent.chat()andopenclawAgent.analyzeFile()without delimiters or "ignore" instructions. - Capability inventory: The skill has the capability to send messages to external platforms (
channel.sendMessage), analyze files (analyzeFile), and perform scheduled tasks (cron.schedule). - Sanitization: No input sanitization, escaping, or validation logic is present in the integration examples to filter potentially malicious instructions from incoming IM messages.
Audit Metadata