openclaw-security-practice-guide
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides curl commands to download security guide documents from
raw.githubusercontent.com/slowmist/openclaw-security-practice-guide/. - [COMMAND_EXECUTION]: The skill includes extensive bash scripts for automated auditing, including
findfor SUID files,sha256sumfor integrity checking, andcrontabmanagement. These are documented as defensive tools to be run by the user or agent. - [PRIVILEGE_ESCALATION]: The documentation mentions
sudoandchown root:rootin the context of protecting the audit scripts, which is a standard security practice for hardening. It also lists common privilege escalation commands (e.g.,chmod 777) as 'Red Lines' that must be blocked or manually approved. - [SAFE]: The external source (SlowMist) is a well-known security firm, and the downloads are static Markdown documents, presenting low risk.
Recommendations
- HIGH: Downloads and executes remote code from: https://example.com/script.sh - DO NOT USE without thorough review
Audit Metadata