OpenClaw or Clawdbot Install Script Execution

Emil Stahl@emilstahl

•updated Feb 24, 2026•8•0•192

This rule detects the execution of install scripts associated with 'OpenClaw' or 'Clawdbot' via various command-line interpreters. It specifically looks for commands involving 'curl', 'wget', 'bash', 'sh', 'zsh', 'pwsh', 'powershell', 'node', or 'npm' that contain specific URLs or package names related to the installation of these tools. This includes shell scripts like 'install.sh', 'install-cli.sh', PowerShell scripts like 'install.ps1', and npm installations like 'npm install -g openclaw'.