OpenClaw’s curl via exec gap leaves AI skills exposed to prompt injection

At a glance

What this is: Mint shows that OpenClaw’s prompt-injection protections are bypassed when skills fetch external content through curl in exec, leaving raw untrusted text to reach model context.

Why it matters: IAM and AI security teams should treat tool-path selection as a governance control, because identity, authorisation, and content-wrapping protections only matter if they apply to every runtime channel into the agent.

By the numbers:

• OpenClaw’s ClawHub listed 6,461 skills as of February 14, 2026, expanding the number of potential runtime paths that can inherit the same control gap.

Context

OpenClaw’s issue is not that prompt injection exists, but that untrusted content can enter the model through a path that bypasses the runtime’s own safety wrapper. In agentic systems, the control problem is often not the presence of a safeguard, but inconsistent enforcement across tools, session types, and execution modes.

This matters because agent skills often mix external content retrieval, command execution, and model prompting in one workflow. When those steps are not governed consistently, the model receives data that the platform intended to treat as untrusted, which weakens the security boundary around the agent itself.

The article’s Moltbook example is typical of a broader agent design pattern, not a one-off flaw. Any skill that relies on shell execution to fetch remote content can create the same governance gap if the runtime only wraps some tool outputs and not others.

Key questions

Q: What breaks when AI agents ingest external content through curl or exec?

A: The main failure is loss of trust boundary enforcement. Raw shell output can reach model context without the wrapping, warning markers, or inspection applied to governed web tools. That makes prompt injection easier to hide inside otherwise legitimate-looking content, and it weakens the runtime assumptions the agent designer thought were in place.

Q: Why does inconsistent tool wrapping increase agent prompt injection risk?

A: Because prompt injection depends on malicious instructions crossing the boundary from untrusted data into trusted context. If one retrieval path is wrapped and another is not, attackers simply target the weaker path. The control failure is structural: the model cannot distinguish safe from unsafe content if the platform does not preserve that distinction consistently.

Q: How can teams tell whether exec approvals are actually working?

A: They should test the exact execution path used in production, not the configuration label. If shell commands that reach the network run without visible allowlist or approval enforcement, then exec approvals are not functioning as a real barrier. The control has to block or mediate the command before output can be passed back into the agent.

Q: When should agent operators treat a scheduled heartbeat as a separate trust boundary?

A: When the scheduled path can ingest external content, execute commands, or trigger autonomous actions without the same controls that govern interactive sessions. Scheduled agent activity often looks operationally routine, but it can bypass session-specific wrapping or policy checks. Treat it as a distinct policy surface whenever the heartbeat can influence downstream model behaviour.

Technical breakdown

Why curl via exec bypasses content wrapping

OpenClaw’s wrapping model is designed to intercept untrusted content before it reaches the LLM, but only some tools go through that pipeline. Web fetch and wrapped search paths receive security markers and warnings, while exec output is returned as raw tool output. When a skill uses curl inside exec, the content arrives in model context without the external-content boundary that the platform uses elsewhere. That makes the protection inconsistent, not absent, which is more dangerous because it can create false confidence in the overall control design.

Practical implication: Apply wrapping at the point where tool output is produced, not only on selected web tools.

Why the cron heartbeat path widens the exposure

The agent’s heartbeat mechanism adds another pathway for external content to enter the system outside the normal hook-session logic. If wrapping is only triggered for sessions identified as hooks, then cron-initiated activity can bypass the check entirely even when the same content is later used by the model. In practical terms, the same skill can receive different safety treatment depending on how it was scheduled, which is a classic identity and execution-governance failure in autonomous systems.

Practical implication: Treat scheduled agent runs as a separate trust boundary and verify that content controls apply there too.

Why exec approvals fail when enforcement is inert by default

Exec approvals are meant to be the last barrier before shell commands run, but their value depends on where enforcement is actually active. If the default host mode does not enforce allowlist or approval checks, then the control exists on paper while the attack path stays open in practice. That is an identity and privilege problem as much as a command-execution problem, because the agent is effectively allowed to perform networked actions without the guardrails the design implies. The result is a control stack that looks layered but behaves unevenly.

Practical implication: Test the real execution path, not the configuration intent, before trusting exec gating.

Threat narrative

Attacker objective: The attacker aims to smuggle malicious instructions into agent context so the model executes or propagates them through autonomous skill workflows.

1. Entry occurs when a skill instructs the agent to fetch remote content with curl through exec instead of a wrapped web tool.
2. Credential or trust abuse follows when the agent processes raw external text as if it were ordinary tool output and carries it into model context.
3. Impact occurs when prompt injection inside that content can influence downstream agent actions, including posting, commenting, or other skill-driven behaviour.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control-path consistency is the real security boundary in agentic systems. OpenClaw does not fail because it lacks a safety concept, it fails because the safety concept is not enforced uniformly across every route into model context. That means the governance question is not whether a wrapper exists, but whether every tool path that ingests external content is forced through it. Practitioners should assume any exception in the path model becomes the preferred attack path.

curl via exec creates a governance blind spot for agent skills. Skills that fetch remote content through shell commands are not just using a different implementation detail, they are sidestepping a control family that was designed around wrapped web tools. In identity terms, this is an authorisation problem for machine actions: the agent is permitted to retrieve and reinterpret external content without the same trust marking that other channels receive. Teams should treat this as a distinct policy domain, not a code-style preference.

Agent scheduling and execution context need their own trust model. The cron versus hook distinction in the article shows how an apparently small runtime difference can change whether security controls fire at all. That is exactly how agent governance debt accumulates: rules exist, but only for the sessions the platform anticipated. Practitioners should map every scheduling path, execution host, and tool wrapper to a single policy model before scaling autonomous skills.

AI agent identity needs more than prompt hygiene. The article reinforces that prompt injection is often the symptom, not the root cause. When an agent can receive raw external content, execute shell commands, and continue acting under a trusted identity, the platform has blurred the line between data ingestion and delegated authority. NHI and agentic AI programmes should treat tool-path control, runtime wrapping, and exec authorisation as one governance stack, not separate teams’ problems.

OpenClaw’s gap is a named example of the exec-to-context trust gap. That gap is the failure to preserve the untrusted status of external text when it moves from command output into model context. It is a useful concept for security reviews because it captures the specific place where safety assumptions collapse. Practitioners should test every agent workflow for this gap before letting skills operate on live external data.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Exec-to-context trust gap: agentic systems fail when external content is allowed to move from command output into model context without preserving its untrusted status. That gap is now a practical governance problem for AI agent programmes, not a theoretical prompt-injection concern. Teams should map where tool output is wrapped, where it is not, and which execution paths can bypass the boundary entirely.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap helps explain why runtime control-path exceptions persist: governance is not yet catching up with the ways agents actually retrieve and process data.

For practitioners

• Audit every skill for curl-in-exec patterns Inventory skills that use shell commands to fetch remote content and flag any path that returns raw output to the model. Replace those flows with wrapped retrieval methods wherever the runtime can enforce external-content boundaries.
• Enforce wrapping on all network-bearing tool output Apply external-content wrapping after command execution whenever the command reaches the network, not only in web_fetch or wrapped search paths. This closes the exec-to-context gap that prompt injection relies on.
• Test scheduled runs separately from hook sessions Validate cron-triggered agent flows as their own trust boundary, because a control that fires for hook sessions can still fail for scheduled heartbeats and other non-hook entry points.
• Harden exec approvals in the real host mode Verify that approval and allowlist controls are actually enforced in the host mode your agent uses in production. If enforcement is inert in the default path, the policy exists only as documentation.

Key takeaways

• OpenClaw’s weakness is not prompt injection itself, but the inconsistent enforcement of content controls across different tool paths into the model.
• When external content is fetched through curl in exec, the runtime can return raw output that bypasses the wrapping designed to mark untrusted text.
• Agent governance has to cover scheduling, execution mode, and content ingestion together, or attackers will target the least protected path.

Key terms

• Exec-to-context trust gap: The exec-to-context trust gap is the failure to preserve the untrusted status of data after a command tool retrieves it. In agentic systems, it appears when shell output is passed into model context without wrapping, markers, or policy checks that keep the data boundary intact.
• External Content Wrapping: External content wrapping is a safety pattern that marks untrusted input so the model can distinguish it from trusted instructions. It does not stop all abuse, but it helps preserve the boundary between source content and system intent when AI tools fetch data from outside the runtime.
• Agent-execution boundary: The transition from model output to a real-world effect, such as a configuration change, API call, or workflow submission. For agents, this boundary matters because a model that decides is not automatically entitled to act, and execution must be separately authorized and logged.
• Control-path mismatch: A control-path mismatch occurs when a security control exists for one route but not for another route that reaches the same sensitive outcome. In this article, the mismatch is between wrapped web-tool paths and raw exec output, which leaves a blind spot attackers can target.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to govern delegated machine actions, privileged automation, and identity risk across modern environments.