Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/workspace-service.js:107
- Evidence
const spawned = spawn(config.nodePath, [serverEntry], {
Security audit
Univer Office
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently connects OpenClaw to Univer Workspace for office-file drafting, review, and export, with sensitive actions disclosed and approval-gated.
Install only if you intend to let OpenClaw work with your Univer Workspace files. Configure a trusted univer-workspace-cli and Workspace URL, review Team Space sharing prompts carefully, and approve merge or discard only when you are ready to change or remove a draft.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
Detected: suspicious.dangerous_exec