2 agent components, declared 8 times in dorothyheavyhanded764/openclaw-docs-i18n: an installer lure (malware delivery pattern).

Components20 MCP servers

High blast radius1credentials, shell or unvetted code

Credentials handed to agents0none seen

Not vetted0of 0 local servers, skills and plugins

Component	Where	Verdict	Blast radius
Installer lure (malware delivery pattern)Installer lure · any agent	README.md	malware pattern	high Archive committed in an agent bundle README links to a committed installer
AGENTS.mdInstructions · any agent	ar/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	en/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	es/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	fr/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	ja/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	ru/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session
AGENTS.mdInstructions · any agent	zh/reference/templates/AGENTS.md	clean	low is read by the agent as instructions on every session

What to do about it

Do not download or run anything from this repository. Its README sends readers to a committed installer and tells them to click past Windows' own warning; that is how the Agent Lure Stealer campaign (Nov 2026) delivers an infostealer. Real skills and MCP servers install from source, never from a ZIP.
For a whole organization (every repo and laptop, rescanned daily, with removal across machines), see Discovery for teams.

Share: https://killerskills.ai/scan/github/dorothyheavyhanded764/openclaw-docs-i18nRescan now Scan another