There is a real risk but probably not directly from someone targeting you. Your agent reading a webpage or email that happens to contain injected instructions is a risk. It is really a surface area problem. I would suggest you ask claude/whatever to scan your OC dirs regularly.
Ask HN: If there has been no prompt injection, is it safe?
11–15 of 15 posts
Re: Ask HN: If there has been no prompt injection, is it safe?
#12I think the more likely attack vector in OpenClaw is convincing it to install a malicious npm package or script, have that siphon all machine/env secrets, and then watch those secrets get abused. (Cloud API key -> crypto mining. Wallet key->theft. Npm credentials->worm publishes more copies of itself. GitHub key->more theft and malicious code upload. Email API key->IP theft and password reset on other systems) Almost…
[flagged]
Re: Ask HN: If there has been no prompt injection, is it safe?
#13[dead]
Re: Ask HN: If there has been no prompt injection, is it safe?
#14The "I'm a small fry" argument assumes that an attacker needs to target you personally. The reality of agentic security (especially with OpenClaw) is that you aren't the target of the hack, you're just the host for the execution.
Re: Ask HN: If there has been no prompt injection, is it safe?
#15[dead]