openclaw-parallels-smoke

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly resolves and acts on public third-party content — e.g., resolving npm tags with "npm view openclaw@beta version dist.tarball", cloning GitHub "main", and optionally reading Discord messages via "openclaw message send/read" — and instructs the agent to parse those results and decide test/restart/upgrade actions, so untrusted external content can materially influence runtime behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs at runtime to serve and point the guest updater at a host-hosted package URL (e.g. http://:/openclaw-.tgz), which the guest downloads and installs (executes remote code) as a required dependency for unpublished-target/update lanes.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt repeatedly instructs the agent/operator to run privileged operations (sudo/root installs, write scripts as root, stop/start VMs, restart services, run global npm installs, modify guest system state and environment), which directly modify machine state and require elevated privileges, so it poses a high risk of compromising the host/guest state.