figo-openclaw-installer

Fail

Audited by Socket on Feb 26, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

The code fragment describes a comprehensive, highly automation-focused installer for OpenClaw with environment checks, configuration collection, docker orchestration, and optional integrations. While the stated purpose is legitimate for a developer-assisted installer, the footprint includes aggressive automation (auto-execution of commands, registry changes, startup script creation) and credential handling (App ID/Secret for Feishu) that require explicit user consent and robust safeguards. The presence of proxy injection, automatic config file writes, and potential persistence mechanisms elevates risk, especially if logs or history leak sensitive data or if the agent misuses inputs. Overall, the design is coherent with an automated installer but exhibits elevated security/risk characteristics that warrant cautious review and explicit user consent mechanisms. Recommended posture: treat as SUSPICIOUS to HIGH-RISK until explicit per-action user approvals and secure handling/logging are confirmed.

Confidence: 98%Severity: 90%
Audit Metadata
Analyzed At
Feb 26, 2026, 08:11 AM
Package URL
pkg:socket/skills-sh/hfqf%2Ffigo-openclaw-install%2Ffigo-openclaw-installer%2F@dc118a6ce8e80b4cb46b8c65243e30a65ee99499