openclaw-setup

Fail

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill recommends a high-risk installation method where a remote shell script from https://openclaw.ai/install.sh is downloaded and executed by piping it directly to bash. This pattern allows a remote server to run arbitrary code on the local system without any verification.
  • [REMOTE_CODE_EXECUTION]: The documentation includes a specialized command for Windows users to download and execute a PowerShell script (https://openclaw.ai/install.ps1) using the iex (Invoke-Expression) command, which facilitates unverified remote code execution.
  • [COMMAND_EXECUTION]: The instructions advise users to modify their shell profiles (such as ~/.bashrc or ~/.zshrc) to update the system PATH. Modifying these configuration files is a persistence mechanism that ensures specific commands or environment modifications are executed every time a new shell session is started.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies, including the openclaw global package and other libraries like node-llama-cpp and sharp. It also recommends cloning source code from a GitHub repository (github.com/openclaw/openclaw.git). These resources originate from an organization that is not part of the verified trusted providers list.
Recommendations
  • HIGH: Downloads and executes remote code from: https://openclaw.ai/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jun 20, 2026, 06:04 PM