openclaw-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs are mixed: most are benign localhost endpoints and placeholders or a GitHub repo, but the presence of direct remote installer scripts (https://openclaw.ai/install.sh and https://openclaw.ai/install.ps1) represents a high‑risk distribution vector unless the domain and scripts are verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The document recommends running install scripts that fetch and execute remote code (curl -fsSL https://openclaw.ai/install.sh | bash and iwr -useb https://openclaw.ai/install.ps1 | iex), so https://openclaw.ai/install.sh and https://openclaw.ai/install.ps1 are runtime-executed external dependencies.