ClawHub
Back to skill

Security audit

OpenClaw Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a documentation skill, but it can present high-impact install and deployment commands that run remote scripts directly without integrity checks.

Install only if you want an OpenClaw documentation helper and will manually review privileged commands before running them. Be especially careful with installer, deployment, repair, daemon, and Tailscale/Node/Docker setup commands: download scripts first, verify publisher checksums or signatures when available, avoid running as root unless necessary, and back up OpenClaw credentials/configuration before repair or update flows.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/02-installation.md:30
Finding

Unverified Remote Installation Scripts Are Executed Directly by Shell Interpreters

Content
View full analysis

Vulnerability Details

File Location: docs/02-installation.md:30-46, 80-92, 113-125, 148, 186-195, 405, 898, 1269-1278; operationalized by the verbatim reproduction requirements in SKILL.md:25-29, 260-273
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash
sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --help
sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install-cli.sh | bash
sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install-cli.sh | bash -s -- --help
powershell
iwr -useb https://openclaw.ai/install.ps1 | iex
sh
curl -fsSL https://raw.githubusercontent.com/openclaw/openclaw-ansible/main/install.sh | bash
dockerfile
RUN curl -fsSL https://bun.sh/install | bash
sh
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git --no-onboard

Technical Analysis

These commands retrieve mutable content from external URLs and pass it directly to bash, sh, or PowerShell's Invoke-Expression. The downloaded payload is not saved for review and is not authenticated through an artifact signature, pinned commit, immutable release identifier, or expected checksum.

HTTPS provides transport protection but does not guarantee that the remote publisher, hosting account, DNS configuration, distribution infrastructure, or future script revisions will remain trustworthy. If any relevant endpoint is compromised, the effective payload can change after this Skill package has been reviewed.

The exposure is amplified by SKILL.md, which instructs the agent not to paraphrase documentation code and to reproduce exact commands. Consequently, a user asking for installation help may receive an immediately executable command ...[truncated 1377 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace direct execution pipelines with a download, verification, inspection, and execution workflow.
  2. Publish installation scripts as immutable, versioned release artifacts.
  3. Publish SHA-256 checksums through an independently protected channel and verify them before execution.
  4. Prefer cryptographic signatures with documented trusted signing keys.
  5. Pin GitHub-hosted content to a full commit hash instead of a mutable branch such as main.
  6. Replace PowerShell Invoke-Expression with a locally downloaded, signature-verified script.
  7. For container builds, pin scripts and base dependencies to immutable versions so builds remain reproducible.
  8. Amend SKILL.md so exact reproduction is subordinate to security review. The Skill should warn users and provide a verified alternative rather than automatically presenting curl | sh or iwr | iex.
  9. Run installers under the least-privileged account possible and require explicit confirmation before service installation or privilege elevation.

A safer general pattern is:

sh
curl -fL --proto '=https' --tlsv1.2 \
  -o install.sh \
  'https://example.invalid/releases/vX.Y.Z/install.sh'

printf '%s  %s\n' 'PUBLISHED_SHA256' 'install.sh' | sha256sum --check -
less install.sh
bash install.sh

The placeholder URL, release, and checksum must be replaced with publisher-provided immutable values.

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/13-deploy.md:83
Finding

Deployment Documentation Executes Multiple Mutable Third-Party Scripts Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: docs/13-deploy.md:83, 1277, 2058-2069, 2375, 2432, 2721-2725, 2772
Vulnerability Type: Remote payload retrieval and immediate execution during deployment
Risk Level: High

Vulnerable Code

sh
curl -fsSL https://get.docker.com | sh
sh
curl -fsSL https://openclaw.ai/install.sh | bash
sh
curl -fsSL https://tailscale.com/install.sh | sh
sh
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

Technical Analysis

The deployment instructions execute scripts from several independent external trust domains. None of the identified commands pins the returned payload to a reviewed digest or verifies a cryptographic signature before execution.

Deployment scripts commonly configure package repositories, install system packages, alter networking, and register services. They are also frequently run with elevated privileges. A compromise of any one upstream endpoint can therefore cross the intended least-privilege boundary and affect the entire deployed host.

The behavior is relevant to the declared deployment functionality, but direct execution of mutable network content is not the minimum privilege or minimum trust necessary to accomplish installation. Verified package repositories, signed release artifacts, and pinned versions can provide the same functionality with substantially less supply-chain risk.

Attack Path

  1. A user requests VPS, Docker, Tailscale, Node.js, or OpenClaw deployment guidance.
  2. The Skill reproduces one of the remote-script pipelines from docs/13-deploy.md.
  3. The user runs the command, potentially through sudo or in a privileged provisioning environment.
  4. A compromised upstream server or publisher account supplies malicious shell content.
  5. The interpreter executes the response with deployment privileges.
  6. The malicious payload modifies package sources, system binaries, networking, cre ...[truncated 558 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace remote bootstrap scripts with signed operating-system packages or documented manual repository setup.
  • Pin Docker, Node.js, Tailscale, and OpenClaw installations to explicit versions.
  • Verify repository signing keys through authenticated, documented fingerprints.
  • Download scripts first and validate a publisher-provided checksum or signature before execution.
  • Avoid running network-fetched scripts directly under sudo or as root.
  • Separate package installation, network configuration, and service enablement into explicit reviewable steps.
  • Require user confirmation before commands that modify repositories, firewall rules, routing, or startup services.
  • Add a security warning to each affected documentation section explaining that HTTPS alone does not validate a mutable script.
  • In automated provisioning, mirror approved artifacts into a controlled internal repository and enforce digest pinning.

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/19-troubleshooting.md:426
Finding

Troubleshooting Guidance Repeatedly Reinstalls Software Through Unverified Remote Shell Pipelines

Content
View full analysis

Vulnerability Details

File Location: docs/19-troubleshooting.md:426, 450, 557-561, 590, 609-621, 678, 1492
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

sh
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git
sh
curl -fsSL https://openclaw.ai/install.sh | bash
sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --beta
sh
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --install-method git
sh
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --verbose
sh
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --beta --verbose
sh
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git --verbose
sh
curl -fsSL https://tailscale.com/install.sh | sh

Technical Analysis

Troubleshooting guidance is especially sensitive because users may execute corrective commands quickly, with elevated privileges, or after disabling safeguards in an attempt to restore service. These commands directly execute mutable remote content and provide no integrity check or local review opportunity.

The beta installation command increases exposure by explicitly selecting a less stable release channel. The --verbose option may also expose additional environment or diagnostic information in terminal logs, although the reviewed evidence does not establish secret leakage by itself.

Reinstalling or repairing software is within the documentation's purpose, but immediate remote execution is not necessary. A pinned and verified installer can perform the same recovery operation while maintaining reviewability and artifact integrity.

Attack Path

  1. An OpenClaw installation fails or exhibits a gateway problem.
  2. The user asks the Skill for troubleshooting assistance. 3 ...[truncated 1064 chars]
Remediation
View remediation

Remediation Suggestions

  • Provide version-specific, checksum-verified recovery packages.
  • Separate diagnosis from reinstallation; do not use a reinstall pipeline as the default troubleshooting action.
  • Download recovery scripts to disk, verify their signatures, and display them for review.
  • Prefer stable releases for recovery unless beta behavior is explicitly required and acknowledged.
  • Warn users not to run verbose diagnostics in public logs and to redact credentials before sharing output.
  • Require backups of configuration and credentials before repair operations.
  • Document rollback procedures and expected file or service changes.
  • Update the Skill instructions to allow safe transformation of hazardous commands instead of requiring verbatim reproduction.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (674)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 8)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/ -->

# OpenClaw - OpenClaw

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 345)May include surrounding context.

{ channel: "whatsapp", accountId: "biz" } },

text
// Optional per-peer override (example: send a specific group to work agent).
{
  agentId: "work",
  match: {
    channel: "whatsapp",
    accountId: "personal",
    peer: { kind: "group", id: "1203630...@g.us" },
  },
},

],

// Off by default: agent-to-agent messaging must be explicitly enabled + allowlisted. tools: { agentToAgent: { enabled: false, allow: ["home", "work"], }, },

channels: { whatsapp: { accounts: { personal: { // Optional override. Default: /.openclaw/credentials/whatsapp/personal // authDir: "/.openclaw/credentials/whatsapp/personal", }, biz: { // Optional override. Default: /.openclaw/credentials/whatsapp/biz // authDir: "/.openclaw/credentials/whatsapp/biz", }, }, }, }, }

text

## Example: WhatsApp daily chat + Telegram deep work

Split by channel: route What

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 534)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/onboarding-overview -->

# Onboarding Overview - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 613)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/wizard-cli-automation -->

# CLI Automation - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 757)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/openclaw -->

# Personal Assistant Setup - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1051)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/hubs -->

# Docs Hubs - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1271)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/architecture -->

# Gateway Architecture - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1271)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/architecture -->

# Gateway Architecture - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1551)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/context -->

# Context - OpenClaw

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The system prompt documentation explicitly includes self-update actions such as config.apply and update.run. In an agent connected to chat channels and tools, normalizing self-modification increases risk that prompt injection or malicious users can steer the system into changing its own configuration, policies, or code paths.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1715)May include surrounding context.

md
*   **Tooling**: current tool list + short descriptions.
*   **Safety**: short guardrail reminder to avoid power-seeking behavior or bypassing oversight.
*   **Skills** (when available): tells the model how to load skill instructions on demand.
*   **OpenClaw Self-Update**: how to run `config.apply` and `update.run`.
*   **Workspace**: working directory (`agents.defaults.workspace`).
*   **Documentation**: local path to OpenClaw docs (repo or npm package) and when to read them.
*   **Workspace Files (injected)**: indicates bootstrap files are included below.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1733)May include surrounding context.

md
OpenClaw can render smaller system prompts for sub-agents. The runtime sets a `promptMode` for each run (not a user-facing config):

*   `full` (default): includes all sections above.
*   `minimal`: used for sub-agents; omits **Skills**, **Memory Recall**, **OpenClaw Self-Update**, **Model Aliases**, **User Identity**, **Reply Tags**, **Messaging**, **Silent Replies**, and **Heartbeats**. Tooling, **Safety**, Workspace, Sandbox, Current Date & Time (when known), Runtime, and injected context stay available.
*   `none`: returns only the base identity line.

When `promptMode=minimal`, extra injected prompts are labeled **Subagent Context** instead of **Group Chat Context**.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 1788)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/session-pruning -->

# Session Pruning - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 2193)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/bootstrapping -->

# Agent Bootstrapping - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 2193)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/start/bootstrapping -->

# Agent Bootstrapping - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 2514)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/oauth -->

# OAuth - OpenClaw

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The docs describe storing access and refresh tokens after OAuth exchange. In context this is expected functionality, but when combined with broad tool access and readable docs injected into agent context, it increases the chance that a prompt-injected agent will seek out those stored tokens on disk.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 2593)May include surrounding context.

md
3.  try to capture callback on `http://127.0.0.1:1455/auth/callback`
4.  if callback can’t bind (or you’re remote/headless), paste the redirect URL/code
5.  exchange at `https://auth.openai.com/oauth/token`
6.  extract `accountId` from the access token and store `{ access, refresh, expires, accountId }`

Wizard path is `openclaw onboard` → auth choice `openai-codex`.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 2781)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/memory -->

# Memory - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 3468)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/retry -->

# Retry Policy - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 3628)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/messages -->

# Messages - OpenClaw

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The documentation enumerates precise credential and secret storage locations, including file-backed secrets and auth profiles. In isolation that is normal admin documentation, but in an agent skill context it materially lowers the effort for a compromised or prompt-injected agent to target high-value files for theft.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 3848)May include surrounding context.

md
*   `~/.openclaw/credentials/<channel>-allowFrom.json` (default account)
    *   `~/.openclaw/credentials/<channel>-<accountId>-allowFrom.json` (non-default accounts)
*   **Model auth profiles**: `~/.openclaw/agents/<agentId>/agent/auth-profiles.json`
*   **File-backed secrets payload (optional)**: `~/.openclaw/secrets.json`
*   **Legacy OAuth import**: `~/.openclaw/credentials/oauth.json` More detail: [Security](https://docs.openclaw.ai/gateway/security#credential-storage-map).

## Updating (without wrecking your setup)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 3874)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/date-time -->

# Date and Time - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 4092)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/typebox -->

# TypeBox - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 4360)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/timezone -->

# Timezones - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 4472)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/typing-indicators -->

# Typing Indicators - OpenClaw

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/01-core-concepts.md (reported line 4708)May include surrounding context.

md
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/model-providers -->

# Model Providers - OpenClaw

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal (+2 more)

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
docs/02-installation.md:1731

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical
Code
suspicious.exposed_resource_identifier
Location
docs/04-channels.md:1884

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/03-gateway.md:238

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/05-providers.md:203

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/06-tools.md:2048

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/09-nodes.md:762

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/19-troubleshooting.md:1328

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/20-experiments.md:1665

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/01-core-concepts.md:2828

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/03-gateway.md:640

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/04-channels.md:1976

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
docs/02-installation.md:960