openclaw-setup
Fail
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends a high-risk installation method where a remote shell script from
https://openclaw.ai/install.shis downloaded and executed by piping it directly to bash. This pattern allows a remote server to run arbitrary code on the local system without any verification. - [REMOTE_CODE_EXECUTION]: The documentation includes a specialized command for Windows users to download and execute a PowerShell script (
https://openclaw.ai/install.ps1) using theiex(Invoke-Expression) command, which facilitates unverified remote code execution. - [COMMAND_EXECUTION]: The instructions advise users to modify their shell profiles (such as
~/.bashrcor~/.zshrc) to update the system PATH. Modifying these configuration files is a persistence mechanism that ensures specific commands or environment modifications are executed every time a new shell session is started. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies, including the
openclawglobal package and other libraries likenode-llama-cppandsharp. It also recommends cloning source code from a GitHub repository (github.com/openclaw/openclaw.git). These resources originate from an organization that is not part of the verified trusted providers list.
Recommendations
- HIGH: Downloads and executes remote code from: https://openclaw.ai/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata