openclaw
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill connects AI agents to external messaging platforms and webhooks, creating a significant attack surface for indirect prompt injection. * Ingestion points: Incoming messages from WhatsApp, Telegram, Discord, and Slack, plus JSON payloads from webhooks (SKILL.md). * Boundary markers: Identity filtering is available (e.g., allowFrom), but no instructions are provided for implementing prompt-level isolation between untrusted data and agent instructions. * Capability inventory: The gateway system allows agents to write to workspaces, orchestrate sub-agents, and execute scheduled tasks. * Sanitization: No content-level sanitization for incoming messages is described.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a global package from a public registry. * Finding: The instructions direct the user to run 'npm install -g openclaw@latest' (SKILL.md).
- [PERSISTENCE]: The skill provides tools for maintaining background execution and automated task scheduling. * Finding: The 'openclaw onboard --install-daemon' command installs a system daemon for background operation (SKILL.md). * Finding: The 'openclaw cron add' command enables recurring tasks that persist across sessions (SKILL.md).
- [COMMAND_EXECUTION]: The skill provides numerous CLI commands for interacting with the local system. * Evidence: Multiple instances of the 'openclaw' CLI being used for gateway management and configuration (SKILL.md).
Audit Metadata