Caveat verdict
slowmist-agent-security
This is a comprehensive security review framework from SlowMist (a reputable blockchain security firm) for AI agents, covering skill installation, GitHub repos, URLs, on-chain addresses, and products; it emphasizes treating all external input as untrusted and requires human decision authority for high-risk items — no malicious behavior present.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (28)
Accesses sensitive system files
patterns/red-flags.md · code · /etc/shadow
Uses eval() — can execute arbitrary code
patterns/red-flags.md · code · eval(
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
patterns/red-flags.md · code · curl | sh
Pipe-to-shell pattern (wget | sh)
patterns/red-flags.md · code · wget | sh
Pipe to bash — executes piped content as shell commands
patterns/red-flags.md · code · | bash
Pipe to sh — executes piped content as shell commands
patterns/red-flags.md · code · | sh
Accesses system credential store
patterns/red-flags.md · code · keychain
Accesses cloud provider credentials
patterns/red-flags.md · code · ~/.aws
Accesses .ssh directory
patterns/social-engineering.md · code · .ssh/
Uses exec() — may execute shell commands
patterns/red-flags.md · code · exec(
References child_process — can spawn system processes
patterns/red-flags.md · code · child_process
References sudo — requests elevated privileges
patterns/red-flags.md · code · sudo
setuid — privilege escalation mechanism
patterns/red-flags.md · code · setuid
Accesses shell history/config
patterns/red-flags.md · code · ~/.zshrc
apt-get install — installs system packages
patterns/red-flags.md · code · apt-get install
subprocess execution — runs system commands from Python
patterns/supply-chain.md · code · subprocess.run(
os.system/popen — direct OS command execution
patterns/supply-chain.md · code · os.system(
Uses XMLHttpRequest — network access
patterns/red-flags.md · code · XMLHttpRequest
Popular HTTP library — network access
patterns/red-flags.md · code · axios
References agent memory files
patterns/red-flags.md · code · MEMORY.md
Sets world-executable permissions
patterns/red-flags.md · code · chmod 777
Changes file ownership
patterns/red-flags.md · code · chown
pip3 install — installs Python packages at runtime
patterns/red-flags.md · code · pip3 install
Instructs covert action — may act without user awareness
patterns/red-flags.md · prose · downgraded · silently
Base64 encoding/decoding
patterns/red-flags.md · code · Base64-encode
Accesses OpenClaw config/secrets directly
templates/report-skill.md · prose · downgraded · ~/.openclaw/openclaw.json
Accesses sensitive environment variables
patterns/red-flags.md · prose · downgraded · process.env.MY_SKILL_API_KEY
Makes HTTP request to external URL
patterns/supply-chain.md · code · fetch('https://
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/B/D/F). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.