OpenClaw’s curl via exec gap leaves AI skills exposed to prompt injection

At a glance

What this is: Mint’s analysis says OpenClaw leaves a security gap when skills use curl through exec to ingest external content, because raw output reaches model context without the wrapping and approval checks applied on other paths.

Why it matters: For practitioners, this shows how agent security fails when controls cover some ingestion routes but not others, especially when AI systems fetch content through shell execution rather than governed tool paths.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Mint’s analysis of OpenClaw’s exec-path prompt injection gap

Context

AI agent security breaks down quickly when untrusted content can enter model context through paths that were never designed to apply the same controls. In this case, the core issue is not the presence of external text itself, but the difference between wrapped tool output and raw shell output in the OpenClaw execution model.

That matters for NHI governance because autonomous skill flows often behave like non-human identities with delegated tool access, yet their access controls are only as strong as the weakest ingestion path. When an agent can retrieve content through exec rather than a governed web tool, the runtime’s trust boundary becomes inconsistent in practice.

Key questions

Q: What breaks when AI agents ingest external content through curl or exec?

A: The main failure is loss of trust boundary enforcement. Raw shell output can reach model context without the wrapping, warning markers, or inspection applied to governed web tools. That makes prompt injection easier to hide inside otherwise legitimate-looking content, and it weakens the runtime assumptions the agent designer thought were in place.

Q: When do command approval controls fail to protect agent workflows?

A: They fail when the runtime path that should enforce approvals is not actually the one being used in production. If host mode, sandbox settings, or tool routing bypass the approval branch, the control exists but does not meaningfully govern execution. Teams should test the deployed branch, not the theoretical control design.

Q: What do security teams get wrong about prompt injection defence?

A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload. Real defence requires examining meaning across the full interaction, including retrieved content and model responses. If the control cannot interpret intent, it will keep missing the attack class it is meant to stop.

Q: Who is accountable when an AI skill bypasses content safety controls?

A: Accountability usually spans the platform team, the operator, and the team that authored or approved the skill. The important point is that runtime behaviour, tool choice, and deployment defaults all shape the security outcome. Governance should assign ownership for the control path, not only for the model or the content source.

Technical breakdown

Why prompt injection survives raw exec output

OpenClaw applies untrusted-content wrapping to certain tool paths, such as web fetch and some search providers, so the model receives explicit markers that the content is external and should not be trusted. The exec path is different. When a skill uses curl or similar shell commands, the response is returned as raw tool output and is not passed through the wrapping pipeline. That means the LLM sees attacker-controlled text without the security envelope that other channels receive. In agent systems, this is a classic control-path consistency problem: the policy exists, but only for some ingestion routes.

Practical implication: treat every shell-based network fetch as an untrusted ingestion path and bring it under the same content controls as governed web tools.

Why exec approvals fail in the default runtime branch

The report describes exec approvals as a potential final barrier, but also shows that enforcement is not active on the default sandbox host path when sandbox mode is off. In effect, the allowlist and deny logic only matters if the runtime is configured to actually evaluate it. That creates a security illusion: the control exists in the codebase, but the most common deployment path does not consistently enforce it. For AI agent governance, this is especially risky because operators may assume command gating is in place when the execution substrate is effectively permissive.

Practical implication: verify where command approval logic is actually enforced, not just whether the code exists, and test the default runtime branch first.

How skills turn a local assistant into a delegated agent

OpenClaw’s skills system gives community-authored markdown instructions execution power through the agent’s toolset. In practice, that means a skill can define how the agent registers, polls, fetches feeds, and acts across external systems. The security consequence is that the skill author, the runtime, and the underlying model all shape the trust boundary. If the skill chooses curl over a wrapped web fetch path, the framework loses the opportunity to label or constrain the returned content. For identity teams, this is a delegation problem as much as a prompt injection problem.

Practical implication: govern skill provenance, tool choice, and runtime permissions together, because any one of them can re-open the trust boundary.

Threat narrative

Attacker objective: The attacker’s objective is to influence agent decisions by getting malicious instructions into model context through an unprotected execution path.

1. Entry occurs when a skill instructs the agent to retrieve external content through curl in exec, placing untrusted network text directly into the workflow.
2. Credential or control access is effectively delegated through the skill’s allowed tool path, which bypasses the wrapping safeguards used by other ingestion routes.
3. Impact follows when injected content reaches model context and can steer agent behaviour, task execution, or downstream actions without the intended guardrails.

NHI Mgmt Group analysis

Control-path consistency is the real governance test for agent security. The article shows that a security model can look sound on paper while still failing at the exact point where skills ingest external content. In NHI and agentic AI programmes, controls must follow the data path, not the intended design diagram. If one route wraps content and another route returns raw text, the governance model is already inconsistent. Practitioners should audit for path-specific trust breaks, not just feature presence.

Exec-based ingestion is a non-human identity problem, not only a prompt injection problem. The skill is acting with delegated runtime authority, which makes its tool access part of the identity model. That means shell execution, command gating, and content provenance need to be governed as one chain. This is where agent identity and NHI control planes intersect most sharply. A skill that can read external content through curl is effectively operating with a trust boundary larger than the organisation may realise. Practitioners should treat tool selection as identity governance.

Shadow AI grows when the secure path is optional and the unsafe path is convenient. The report describes a framework that protects wrapped tools but leaves shell retrieval as an easier bypass. That pattern scales beyond one product because developers will choose the shortest path to functional automation. The governance lesson is that agent systems need default-safe tool routing, not just isolated safeguards. If the safer path is not enforced, the weaker path becomes the de facto operating model. Practitioners should align policy, tooling, and runtime defaults.

Prompt injection exposure becomes materially worse when command approvals are inert by default. This is a control assurance issue, not just a detection gap. When approvals only activate in certain host modes, operators can mistake configuration for enforcement and leave a large portion of the runtime unprotected. For identity and security teams, that is the same class of failure seen when privileged access policy exists but is not consistently enforced at runtime. Practitioners should validate effective control coverage, not declared control design.

What this signals

The wider signal for identity programmes is that agent security will keep failing wherever tool routing is allowed to diverge from policy enforcement. Control-path drift: this is the gap that opens when the approved security path is not the path developers actually use, and it is especially dangerous in NHI-like agent workflows. Teams should review their runtime defaults, command approvals, and external-content handling together, then compare them with the guidance in the NIST AI Risk Management Framework and OWASP Agentic AI Top 10.

For practitioners, the immediate planning question is whether the safe path is mandatory or merely available. If a skill can reach external data through a raw shell command, then prompt injection defence depends on operator discipline instead of enforced architecture. That should trigger a review of skill approval, tool allowlisting, and identity-style ownership for each delegated agent capability.

For practitioners

• Audit every external-content ingestion path Map where agents fetch or receive untrusted text, then verify whether each path receives the same wrapping, sanitisation, and policy checks as the approved web tools.
• Block shell-based network fetches by policy Restrict curl, wget, and similar commands in agent execution contexts unless they are explicitly wrapped and routed through approved inspection logic.
• Validate exec approvals in the default runtime Test the actual host mode and sandbox settings that run in production, then confirm the approval checks are active on the branch your agents really use.
• Rework skills to prefer governed fetch tools Rewrite skill instructions so external retrieval uses the framework’s wrapped web paths instead of raw shell execution, especially for feeds, posts, and API responses.

Key takeaways

• The article’s central warning is that agent security fails when untrusted content can bypass the wrapped tool path and arrive in model context as raw output.
• The evidence points to a control assurance problem, not a single bug, because approvals and wrapping only protect the paths they actually govern.
• Practitioners should treat agent skills, shell execution, and external content handling as one identity governance surface, not three separate technical issues.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• External Content Wrapping: External content wrapping is a safety pattern that marks untrusted input so the model can distinguish it from trusted instructions. It does not stop all abuse, but it helps preserve the boundary between source content and system intent when AI tools fetch data from outside the runtime.
• Control Path Drift: The divergence between the secure route an organisation intended and the route people or systems actually use. It often appears when controls are too rigid, poorly designed, or detached from workflows, and it turns policy into workaround behaviour.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

What's in the full report

Mint's full analysis covers the operational detail this post intentionally leaves for the source:

• Code-path evidence showing where external-content wrapping is applied and where exec output bypasses it
• The sandbox-host enforcement gap that makes exec approvals inert in the default branch
• The full Moltbook skill chain, including curl-based registration, heartbeat polling, and feed ingestion
• Version-specific references and line-level findings from the OpenClaw codebase

👉 Mint’s full report covers the attack path, control gaps, and code-level findings in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into operating rules for delegated systems and agentic workflows.