openclaw-windows-node
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill exposes a
system.runcapability which allows an AI agent to execute arbitrary shell commands on the host Windows system. - [DATA_EXFILTRATION]: Provides capabilities for
screen.snapshot,camera.snap, andstt.transcribe(audio recording), enabling the agent to capture sensitive environment data and transmit it to a remote gateway via WebSocket. - [PERSISTENCE]: The
DeepLinkServicemodifies the Windows Registry to register theopenclaw://URI scheme, creating a mechanism for the application to be triggered by external links. - [DYNAMIC_EXECUTION]: The
canvas.presentcapability usesWebView2to render HTML content or navigate to URLs provided by the agent, potentially allowing execution of scripts within the application's context. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for instructions embedded in data.
- Ingestion points: Processes JSON requests from a WebSocket gateway in
NodeService.HandleNodeRequestAsync. - Boundary markers: No explicit delimiters or ignore-instructions markers are implemented in the capability handlers.
- Capability inventory: Includes shell execution (
system.run), screen capture, camera access, and audio transcription. - Sanitization: The implementation snippets do not show validation or sanitization of parameters before they are passed to sensitive host-level functions.
- [REMOTE_CODE_EXECUTION]: Includes an
UpdateServicethat identifies, downloads, and installs new versions of the software from the vendor's GitHub Releases repository.
Audit Metadata