openclaw-zero-token
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads its full implementation and dependencies from an untrusted GitHub repository (
github.com/linuxhsj/openclaw-zero-token.git). - [REMOTE_CODE_EXECUTION]: Fetches and executes a setup script from NodeSource's official domain to configure the Node.js environment.
- [PRIVILEGE_ESCALATION]: The installation instructions require the user to run commands with root privileges (
sudo) to install Node.js and system dependencies. - [COMMAND_EXECUTION]: Provides an
exectool that enables the AI agent to run arbitrary shell commands on the host machine. - [CREDENTIALS_UNSAFE]: The software captures and stores highly sensitive browser data, including session cookies and authentication tokens, in local files (
data/auth/). This creates a significant risk of credential exposure if the untrusted codebase is malicious. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: External data enters the agent context through the
web_fetchandweb_searchtools (SKILL.md). - Boundary markers: The documentation mentions prompt injection middleware, but there is no evidence of robust delimiters or warnings to ignore instructions in fetched data.
- Capability inventory: The skill includes high-risk capabilities such as
exec(shell execution),write(file system modification), andcurl(network operations). - Sanitization: There is no description of sanitization or validation processes for data retrieved from untrusted web sources.
Recommendations
- AI detected serious security threats
Audit Metadata