Ongoing Security, Privacy, and Authorization Risks

Reports of malicious skills and alleged OpenClaw-linked operations remain unverified or technically under-documented. Recent practical guidance reinforces separation of protected source data, agent workspace, and sandbox runtime, while warning that tools may run as the host user unless sandboxing is configured; these are useful controls, not evidence of safe defaults.