openclaw-crabbox

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime setup may run "git clone https://github.com/openclaw/crabbox.git" and build/execute the fetched Crabbox code, so this URL is used at runtime to fetch and run remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt explicitly includes commands that invoke sudo to create symlinks in system directories (e.g. sudo ln -sf ... /usr/local/bin/...), which instructs modifying system files that require elevated privileges.