OpenClaw Windows WSL2 Install Guide

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:58 AM UTC
• Version: 1.1.0

Overview

This is a coherent OpenClaw WSL installation guide, but it asks users to run an unverified remote installer and make broad administrator/root security changes.

Before installing, review the commands instead of running the guide blindly. Avoid passwordless sudo and routine root use, verify the OpenClaw installer from an official source before executing it, restrict any firewall rule to only the access you need, and re-enable any security protections immediately if you temporarily change them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:369
• Finding: Unverified Remote Installation Script Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:369` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ```bash curl -fsSL https://molt.bot/install.sh | bash ``` ### Technical Analysis The command pipes a mutable response from an external domain directly into Bash. It provides no version pinning, checksum verification, digital-signature verification, local inspection, or confirmation prompt. Consequently, the code audited in this package does not define the effective installation payload. The external server can change the script after the Skill has been reviewed. The project also does not establish that `molt.bot` is an authoritative OpenClaw distribution source. Using HTTPS protects transport integrity under normal circumstances, but it does not protect against compromise of the source server, malicious upstream changes, domain control loss, or a compromised publishing process. ### Attack Path 1. A user follows the installation guide and runs the command inside WSL. 2. The external server, or an attacker controlling its publishing infrastructure, supplies modified shell code. 3. `curl` writes the response directly to the Bash process without saving it for inspection. 4. Bash executes the attacker's commands with the privileges of the current WSL user. 5. If the guide's passwordless sudo recommendation has also been applied, the payload can invoke `sudo` without authentication and obtain WSL root privileges. ### Impact Assessment The payload can execute arbitrary commands as the current WSL user, access that user's files and credentials, modify shell configuration, install additional software, and alter OpenClaw configuration. In combination with unrestricted passwordless sudo, it can gain complete root control of the WSL distribution. Data reachable from WSL, including mounted Windows files accessible to that account, may also be exposed or modified. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | bash` pipeline. - Download a version-pinned installer or release artifact from a documented official source. - Publish and verify a trusted SHA-256 checksum or publisher signature before execution. - Save the installer locally and allow the user to inspect it before running it. - Run installation with an ordinary WSL account and elevate only individual commands that demonstrably require root access. - Apply strict failure handling and document the expected files and system changes. - If a bootstrap script remains necessary, pin both its immutable version and expected digest rather than trusting the current response at a mutable URL. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:275
• Finding: Persistent Unrestricted Passwordless Sudo Granted to the OpenClaw User<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:275` **Vulnerability Type**: Unrestricted persistent privilege escalation **Risk Level**: High ```bash echo "openclaw ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers ``` ### Technical Analysis This sudoers entry permits the `openclaw` account to execute every command as any user, including root, without authentication. The grant persists across sessions and is substantially broader than the privileges needed to install or operate an application. The command also appends directly to `/etc/sudoers` instead of using a dedicated file under `/etc/sudoers.d` and validating it with `visudo`. A syntax error or conflicting entry could damage sudo operation. This configuration materially amplifies the remote-installer risk because any process compromised under the `openclaw` account can silently become root. ### Attack Path 1. The user adds the recommended sudoers entry. 2. A remote installer, OpenClaw component, dependency, or other process running as `openclaw` is compromised. 3. The compromised process executes an arbitrary command through `sudo`, such as modifying system configuration or installing a privileged payload. 4. Sudo grants root privileges without requesting a password or requiring further user approval. 5. The attacker obtains full control over the WSL distribution. ### Impact Assessment An attacker controlling any process under the affected account can obtain root privileges, read or modify all WSL files, change system configuration, replace executables, tamper with services, and establish persistence within the distribution. The privilege grant applies to all commands rather than only those required by OpenClaw. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `NOPASSWD: ALL` recommendation and retain normal password-authenticated sudo. - Elevate only individual installation commands that require system modification. - If noninteractive automation is essential, permit only an explicit allowlist of commands with fixed absolute paths and tightly constrained arguments. - Store any narrowly scoped policy in `/etc/sudoers.d/openclaw`. - Create or edit the policy using `visudo` and validate it with `visudo -cf`. - Remove temporary privilege rules immediately after installation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:72
• Finding: Blanket Requirement to Perform Installation Operations as Windows Administrator<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72-77` **Vulnerability Type**: Excessive Windows administrator privileges **Risk Level**: Medium ```text All following operations must be run as administrator: 1. Press Win + X 2. Select Windows Terminal (Admin) 3. Accept UAC prompt, you are now in admin terminal ``` ### Technical Analysis Some WSL setup operations—such as enabling Windows optional features and changing boot configuration—legitimately require elevation. However, the guide states that all following operations must use an administrator terminal. Later activities include downloads, routine WSL management, configuration, and application setup that do not uniformly require Windows administrator rights. Keeping the entire workflow in an elevated terminal violates least privilege and causes unrelated commands or user mistakes to execute with unnecessarily broad host permissions. The UAC instruction is an ordinary elevation instruction, not evidence of AI prompt injection, but its scope is excessive. ### Attack Path 1. The user opens a Windows terminal with administrator privileges and retains it for the entire guide. 2. The user executes later download, troubleshooting, or third-party installation instructions from that terminal. 3. A malicious command, compromised installer, or accidental destructive command inherits elevated Windows privileges. 4. The command modifies host-level configuration or protected resources that would have been inaccessible from a standard terminal. ### Impact Assessment Commands executed in the elevated Windows terminal may alter protected host configuration, Windows optional features, boot settings, firewall rules, system-wide environment variables, and other administrator-controlled resources. The risk extends beyond the permissions required for ordinary OpenClaw installation and use. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Identify each command that specifically requires Windows elevation. - Use an administrator terminal only for enabling required Windows features, changing necessary boot settings, and creating any justified firewall rule. - Close the elevated terminal immediately after those operations. - Perform downloads, WSL application installation, configuration, and routine service management from a standard terminal. - Add privilege annotations next to individual commands instead of applying a blanket administrator requirement. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:291
• Finding: Guide Endorses Routine Direct Root Use in WSL<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:291-300` **Vulnerability Type**: Excessive Linux privileges **Risk Level**: Medium ```text ### Option 2: Use root directly (simpler, for experienced users) If you prefer simplicity and don't want to create a separate user, you can just keep using root. No extra configuration needed. Notes: Runs everything with full root permissions, less secure than normal user. Both options work fine for installing and running OpenClaw. ``` ### Technical Analysis The guide presents persistent direct root use as a supported convenience option for installation and daily operation. OpenClaw does not need unrestricted root privileges for routine user-level execution. Running network-facing or dependency-rich application code as root removes a key privilege boundary and increases the consequences of command injection, dependency compromise, and operator error. Although the guide acknowledges that root is less secure, it still normalizes this configuration as functionally equivalent to ordinary-user operation. ### Attack Path 1. The user selects the direct-root option. 2. OpenClaw, its installer, or one of its dependencies runs in the root session. 3. A malicious dependency, remote payload, or exploitable application flaw executes commands. 4. Those commands immediately inherit full root privileges without needing a separate escalation vulnerability. ### Impact Assessment A compromised process can modify any file in the WSL distribution, replace system binaries, alter service definitions, access other users' data, change networking, and install persistent components. The resulting scope is the entire WSL environment rather than one unprivileged user account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove direct root use as a recommended operating mode. - Require creation and use of a dedicated, unprivileged OpenClaw account. - Use sudo only for specific package-management or system-configuration commands. - Run the OpenClaw gateway and related services under the unprivileged account. - Document file ownership and permissions needed by the application rather than bypassing permission boundaries with root. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:359
• Finding: Unrestricted Inbound Firewall Rule Exposes the OpenClaw Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:359` **Vulnerability Type**: Overly broad network exposure **Risk Level**: Medium ```powershell New-NetFirewallRule -DisplayName "OpenClaw-Service" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 18789 ``` ### Technical Analysis The rule permits inbound TCP traffic to port 18789 without restricting the Windows network profile, interface, or remote source address. If the service listens on a network-reachable interface, this may make it accessible from untrusted local networks. The guide primarily describes local browser access. For that use case, a broad inbound firewall exception is not the minimum permission necessary; loopback-only service binding or a narrowly scoped rule would be safer. ### Attack Path 1. The user creates the unrestricted inbound firewall rule. 2. OpenClaw listens on port 18789 through WSL mirrored networking or another reachable interface. 3. A device on a connected network probes or connects to the exposed port. 4. The remote party attempts to exploit weak authentication, configuration errors, or vulnerabilities in the OpenClaw service. ### Impact Assessment The rule expands the attack surface of the OpenClaw gateway to network peers. Actual compromise depends on the service's binding, authentication, and vulnerabilities, but the firewall configuration removes a host-level control that would otherwise limit remote access. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer binding the service to `127.0.0.1` when only local browser access is required. - Do not create an inbound firewall rule unless remote access is explicitly needed. - If remote access is required, restrict the rule to the Private profile, the intended interface, and explicitly trusted remote addresses. - Require service authentication and encrypted transport before allowing network access. - Document how to remove the rule when OpenClaw is uninstalled or remote access is no longer required. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:522
• Finding: Troubleshooting Recommends Disabling Third-Party Antivirus Protection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:522` **Vulnerability Type**: Disabling endpoint security controls **Risk Level**: Medium ```text Temporarily disable third-party antivirus ``` ### Technical Analysis The troubleshooting guidance recommends disabling antivirus protection when WSL installation produces a permission-related error. It does not first require examination of security logs, verification of installer signatures, use of official compatibility guidance, or a narrowly scoped exclusion. It also does not explicitly require immediate restoration and verification of protection. This is particularly risky because the guide separately directs users to download and execute remote installation content. ### Attack Path 1. The user encounters the documented installation error. 2. The user disables endpoint protection as instructed. 3. The user retries installation or executes other downloaded content while detection and blocking are reduced. 4. A malicious or compromised payload executes with a lower likelihood of prevention or detection. 5. The user may leave protection disabled because the guide does not provide a mandatory restoration check. ### Impact Assessment Disabling antivirus weakens host-wide detection and prevention during a sensitive installation workflow. Malicious files or processes may execute, persist, or access data with less chance of being blocked. The exact privileges remain those of the process executing the payload, potentially including administrator privileges under the guide's blanket elevation instructions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove disabling antivirus as a default troubleshooting action. - First inspect antivirus and Windows event logs to identify the blocked component. - Verify that all installers are obtained from official sources and have valid publisher signatures. - Prefer a narrowly scoped, time-limited exclusion for a verified file or directory if the security vendor documents it as necessary. - If protection must be disabled, disconnect from untrusted networks, minimize the disabled interval, and provide explicit steps to re-enable and verify protection immediately afterward. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:532
• Finding: Troubleshooting Recommends Disabling Windows Memory Integrity<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:532` **Vulnerability Type**: Disabling operating-system exploit mitigation **Risk Level**: Medium ```text Disable Core Isolation in Windows Defender: Windows Security → Device Security → Core Isolation → Memory Integrity → Off ``` ### Technical Analysis Memory Integrity is a Windows virtualization-based security control intended to protect kernel-mode code integrity. The guide recommends turning it off to troubleshoot a WSL startup error without requiring confirmation of a documented incompatibility, without identifying a specific incompatible driver, and without providing mandatory restoration steps. Disabling a host kernel-hardening control is broader than the privileges necessary to install OpenClaw and may expose the system to unrelated vulnerable or malicious kernel components. ### Attack Path 1. The user encounters the specified WSL startup error. 2. The user disables Memory Integrity and reboots as instructed. 3. A vulnerable, untrusted, or malicious driver subsequently loads without the protection previously enforced by Memory Integrity. 4. An attacker exploits the weakened kernel boundary to obtain broader host control. 5. The system remains exposed if the user does not re-enable the protection. ### Impact Assessment The recommendation weakens a host-wide kernel security boundary. It may increase exposure to malicious or vulnerable drivers and kernel-level exploitation. Successful exploitation could affect the Windows host rather than only the WSL distribution, although actual compromise requires an additional vulnerable or malicious kernel component. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not recommend disabling Memory Integrity as a general troubleshooting step. - Diagnose the specific incompatible driver or component using Windows Security and event logs. - Update or remove incompatible drivers and install current signed Windows and WSL updates. - Refer users to official Microsoft compatibility guidance. - If temporary disabling is demonstrably unavoidable, document the precise reason, limit the duration, require immediate re-enablement, and verify after reboot that Memory Integrity is active. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
sudo sed -i 's|http://archive.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list
sudo sed -i 's|http://security.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list
sudo apt update && sudo apt upgrade -y
```

After completing, skip to Chapter 4. / 完成后跳转到第四章继续。

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

• Category: Supply Chain

Content

Run after entering WSL: / 进入 WSL 后执行：
```bash
curl -fsSL https://molt.bot/install.sh | bash
```

**4.4 Fix PATH Environment Variable / 修复 PATH 环境变量**

• Confidence: 99% confidence
• Finding: `curl -fsSL https://molt.bot/install.sh | bash` is direct remote code execution from a network source with no inspection, checksum verification, signing, or version pinning. Because this appears in a step-by-step installation guide, users are highly likely to execute it verbatim, making the risk concrete rather than theoretical.

Chaining Abuse

High

• Category: Tool Misuse

Content

Run after entering WSL: / 进入 WSL 后执行：
```bash
curl -fsSL https://molt.bot/install.sh | bash
```

**4.4 Fix PATH Environment Variable / 修复 PATH 环境变量**

• Confidence: 99% confidence
• Finding: The `| bash` pipeline turns fetched remote content directly into executed shell code, eliminating opportunities for review or integrity checking. In context, this is one of the most dangerous patterns in the guide because it normalizes blind execution during installation.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

n after entering WSL: / 进入 WSL 后执行：
```bash
curl -fsSL https://molt.bot/install.sh | bash
```

**4.4 Fix PATH Environment Variable / 修复 PATH 环境变量**

If after installation it says `openclaw` command not found, that means npm global bin directory isn't in PATH: / 如果安装完成后提示 `openclaw` 命令找不到，说明 npm 全局 bin 目录没有加入 PATH：
```bash
echo 'export PATH="/home/openclaw/.npm-global/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
```

Verify: / 验证：
```bash
which openclaw
openclaw --version
```

**4.5 Run Initialization Wizard / 运行初始化向导**
```bash
openclaw setup
```

Follow the wizard prompts to complete configuration. / 按照向导提示完成配置即可。

---

## Chapter 5: LLM Model Configuration / 第五章：LLM 模型配置

After installing OpenClaw, you need to configure your own LLM API key in the setup wizard. You can choose any LLM provider that fits your needs. Common options include:
安装完成�

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Run inside WSL: / 进入 WSL 后执行：
```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl wget git
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 给用户设置密码（输入时无回显，务必牢记）
passwd openclaw

# 3. Add user to sudo group for admin privileges
# 给用户赋予 sudo 管理员权限
usermod -aG sudo openclaw

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 给用户设置密码（输入时无回显，务必牢记）
passwd openclaw

# 3. Add user to sudo group for admin privileges
# 给用户赋予 sudo 管理员权限
usermod -aG sudo openclaw

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 给用户设置密码（输入时无回显，务必牢记）
passwd openclaw

# 3. Add user to sudo group for admin privileges
# 给用户赋予 sudo 管理员权限
usermod -aG sudo openclaw

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 给用户设置密码（输入时无回显，务必牢记）
passwd openclaw

# 3. Add user to sudo group for admin privileges
# 给用户赋予 sudo 管理员权限
usermod -aG sudo openclaw

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 配置 WSL 默认登录用户为刚创建的用户
echo -e "[user]\ndefault = openclaw" >> /etc/wsl.conf

# 5. (Recommended) Configure passwordless sudo to avoid repeated typing during install
# 配置 sudo 免密（推荐，避免安装过程频繁输入密码）
echo "openclaw ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
```

• Confidence: 97% confidence
• Finding: The step explicitly recommends configuring passwordless sudo, which removes a key friction point protecting privileged operations. In this setup context, where users may later run fetched scripts and third-party tools, that change significantly amplifies the blast radius of any compromise.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Appending `openclaw ALL=(ALL) NOPASSWD: ALL` to `/etc/sudoers` grants unrestricted passwordless root access to that account, dramatically lowering the barrier for privilege escalation from any compromised shell, package, or application running as that user. The guide even labels this as recommended, without a strong warning or safer scoping, which materially increases risk for end users.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo -e "[user]\ndefault = openclaw" >> /etc/wsl.conf

# 5. (Recommended) Configure passwordless sudo to avoid repeated typing during install
# 配置 sudo 免密（推荐，避免安装过程频繁输入密码）
echo "openclaw ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
```

• Confidence: 99% confidence
• Finding: Writing `NOPASSWD: ALL` to `/etc/sudoers` gives the named user unrestricted passwordless root access. Combined with subsequent installation of external software, this creates a straightforward privilege-escalation path if the account or installed tooling is compromised.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The guide instructs users to execute a remote script directly with `curl ... | bash`, which gives unaudited network content immediate code execution on the user's system. In a setup guide context this is especially dangerous because users are primed to trust and run commands as-is, and there is no integrity verification, pinning, or warning about reviewing the script first.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **Cause / 原因**: Network connectivity to GitHub is unstable in China / 国内网络访问 GitHub 不稳定
- **Solution / 解决**: Use ghproxy.com mirror to download, e.g.: / 使用 ghproxy.com 镜像下载，例如：
  ```bash
  curl -fSL https://ghproxy.com/https://github.com/microsoft/WSL/releases/download/2.3.26/wsl.2.3.26.0.x64.msi -o wsl-install.msi
  ```

---

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese-language installation guide, with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking audience. This can be a natural-language policy issue when a skill implicitly enforces a language/locale without opt-in or documented justification.

Static analysis

No suspicious patterns detected.