openclaw

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly tells the agent to "get API key" for OpenAI and several third‑party services and to configure and test those integrations (with no instruction to use environment variables or secure CLI auth), which implies collecting and embedding secret values into configs/commands and thus creates a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill routinely clones/pulls an upstream public repository into ~/.openclaw-config / ~/.openclaw/repo (see the bootstrap curl to raw.githubusercontent.com and git pull in cmd_upgrade/cmd_status) and copies upstream workflow/templates (e.g., ~/.openclaw-config/workflows/* and devops/health-check.md) into runtime locations — including using devops/health-check.md as an appended system-prompt for the scheduled claude job — so untrusted third-party repo content can directly influence agent prompts and actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill writes files and cron jobs into the user's home, and explicitly installs an automated cron job that runs the Claude CLI with a --dangerously-skip-permissions flag (bypassing security checks), which constitutes a direct security/state compromise.