openclaw-multi-channel-ai-assistant
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to install the platform by piping a remote script directly to a shell:
curl -fsSL https://get.openclaw.ai | bash. This executes unverified code from an external domain that is not recognized as a trusted source. - [EXTERNAL_DOWNLOADS]: The documentation encourages downloading and executing a shell script from an untrusted repository:
wget https://github.com/openclaw/openclaw/releases/latest/download/install.sh, followed bychmod +x install.shand./install.sh. - [INDIRECT_PROMPT_INJECTION]: The architecture described in the skill creates a significant surface for indirect prompt injection attacks by processing raw messages from external chat platforms (Telegram, WhatsApp, Discord) and connecting them to high-privilege tools.
- Ingestion points: Raw message content is ingested via channel adapters (e.g.,
MyChannelAdapterinSKILL.md) and routed directly to the agent. - Boundary markers: The skill lacks examples or instructions for using robust boundary markers or "ignore embedded instructions" delimiters when processing these external messages.
- Capability inventory: The skill documentation details the use of tools for browser automation, web search (SearXNG), and code execution, which can be maliciously triggered via injected text.
- Sanitization: There is no mention or demonstration of input sanitization or validation for data coming from these external channel providers before it is processed by the AI models.
Recommendations
- HIGH: Downloads and executes remote code from: https://get.openclaw.ai - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata