secure-openclaw-ai-assistant
Fail
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches installation scripts from Composio, OpenCode, and Docker repositories to set up the necessary environment.- [REMOTE_CODE_EXECUTION]: Installation commands for third-party tools use piped shell execution patterns (e.g., curl | bash) to automate setup.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from messaging platforms (WhatsApp, Telegram, etc.) and possesses powerful system tools.
- Ingestion points: Platform-specific adapters and listeners defined in config.js and adapters/discord.js.
- Boundary markers: None defined in the instructions to separate external data from internal prompts.
- Capability inventory: Grants the agent access to Bash, Write, and Edit tools via agent.allowedTools.
- Sanitization: Relies on the user-in-the-loop approval mechanism described in the tool permission handler section.- [PERSISTENCE]: The skill establishes persistence by modifying shell configuration files and creating scheduled tasks.
- Appends environment variables to shell profiles like ~/.zshrc and ~/.bashrc for long-term credential availability.
- Creates cron jobs to handle scheduled reminders and tasks.- [COMMAND_EXECUTION]: The deployment instructions involve executing administrative commands such as swap file creation, firewall rule modifications (ufw allow 4096), and container management.
Recommendations
- HIGH: Downloads and executes remote code from: https://composio.dev/install, https://get.docker.com, https://opencode.ai/install - DO NOT USE without thorough review
Audit Metadata