openclaw-live-updater

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow runs scripts/update-main.mjs, which ingests outsider-authored free text from the managed Gateway’s runtime logs (RPC/CLI output parsed as JSON lines and summarized), and those log messages are then included in the agent’s returned context for reporting/diagnosis.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The updater script (scripts/update-main.mjs) fetches and fast‑forwards origin/main for the repository "openclaw/openclaw" at runtime and then builds/restarts the Gateway (running dist/index.js), so remote git content from openclaw/openclaw fetched during runtime can result in execution of that code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to stop/restart and retarget LaunchAgent/launchd entrypoints, replace ProgramArguments in service plists, and stop/relaunch macOS apps—all system-level mutations that alter the machine's state and service configuration.