zeroclaw

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These links point to a third‑party GitHub repo and a raw bootstrap shell script (explicitly suggested to be run via curl|bash or executed after cloning); while GitHub hosting is common, executing remote scripts or unknown prebuilt binaries from an unverified account can run arbitrary/malicious code, so it is a significant risk unless you verify the repository, inspect the script, and validate maintainers/releases.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly documents binding public channels and running the autonomous daemon (e.g., "Deploy as daemon with Telegram" and the [channels] list including Telegram/Discord/Slack/Webhook), which means the agent runtime ingests untrusted, user-generated third-party messages that can drive decisions or tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). I flagged https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/main/scripts/bootstrap.sh (and the git clone of https://github.com/zeroclaw-labs/zeroclaw) because the installation instructions include curl ... | bash and git clone ... && ./bootstrap.sh, which fetch and execute remote code at runtime and are presented as required bootstrap steps.