openclaw-ops
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs extensive shell operations on the host machine, including using
sudofor service installation (openclaw gateway install), DNS configuration (openclaw dns setup --apply), and file permission changes (chmod) during security audits. - [REMOTE_CODE_EXECUTION]: The skill is designed to manage remote systems by executing arbitrary commands via
ssh. It includes detailed instructions for establishing reusable connections and usingsshpassfor automated password authentication. - [CREDENTIALS_UNSAFE]: The skill explicitly accesses and manages sensitive paths such as
~/.openclaw/credentials/,~/.ssh/config, and environment variables containing API tokens. While it includes instructions to avoid logging secrets, the inherent access to these paths presents a credential exposure risk. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to install and update software using
npm install -g openclaworpnpm, which fetches code from external package registries. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It is instructed to read and process untrusted data from multiple sources, including system logs (
openclaw logs), incoming chat messages (openclaw message read), and external web content via a controlled browser (openclaw browser screenshot/snapshot). This data is then used within a context that has high-privilege execution capabilities (SSH, shell access). - Ingestion points: Reads data from
openclaw logs,openclaw message read, andopenclaw browser snapshot(References: SKILL.md, references/debug.md, references/misc-modules.md). - Boundary markers: No explicit delimiter or "ignore instructions" markers are defined for interpolating this untrusted data into prompts.
- Capability inventory: High-privilege access including
ssh(remote execution),sudo(privilege escalation), file writes (tee,cp), and service management (References: references/connect.md, references/operations.md). - Sanitization: No input validation or sanitization of external content is specified before processing.
Audit Metadata