zopenclaw

No direct malicious behavior (e.g., exfiltration, backdoors, reverse shells) is evident in this snippet. However, it performs multiple high-impact trust actions: it executes an external installer via curl|sh and installs npm packages using @latest (both can run arbitrary code at install time), and it persistently stores a reusable Tailscale auth key in /root/.zo_secrets and auto-sources it from /root/.bashrc, increasing the consequences of any host compromise. These factors warrant careful review/pinning of versions and tightening of secret handling, especially around openclaw/mcporter install scripts and the Tailscale installer integrity in your threat model.