openclaw-inter-instance
Warn
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides explicit instructions and examples for using the
nodes.runtool to execute arbitrary shell commands on remote linked machines, including repository cloning and system link creation. - [PROMPT_INJECTION]: The skill instructs the agent to use
CRITICAL IDENTITYforced declarations to override internal model personas or constraints, specifically targeting models like GLM-5. It also defines a surface for indirect prompt injection through its core multi-agent communication features. - Ingestion points: Inter-agent messaging via
sessions_sendand remote memory file ingestion. - Boundary markers: No delimiters or isolation instructions are provided for incoming agent messages.
- Capability inventory:
nodes.run(remote command execution) andsessions_send(inter-agent messaging). - Sanitization: No sanitization or validation of external instructions from other instances is implemented.
- [DATA_EXFILTRATION]: The skill establishes communication channels between instances and external messaging services like Telegram, which could be leveraged to exfiltrate data if the agent or a linked node is compromised.
Audit Metadata