zopenclaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly configures mcporter to add Zo's MCP endpoint (https://api.zo.computer/mcp) in Step 6 and the architecture notes, which bridges web_search, email, and messaging tools into the OpenClaw agent—meaning the agent will fetch and interpret untrusted public/web and user-generated content as part of its workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install script runs at runtime and explicitly executes remote code via "curl -fsSL https://tailscale.com/install.sh | sh", so the URL https://tailscale.com/install.sh is a runtime external dependency that fetches and executes code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill instructs installing system binaries, writing startup scripts to /usr/local/bin, registering persistent services and modifying system- and root-owned configs (Tailscale, gateway, supervisor), actions that require elevated privileges and can persistently change or compromise the machine state.