The software contains a command injection issue in the `scripts/update-clawtributors.ts` script. This affects contributors or maintainers, and CI systems, who execute `bun scripts/update-clawtributors.ts` on a source checkout containing a malicious commit author email. The script extracts a GitHub login from `git log` author metadata and uses it in a shell command via `execSync`. A crafted commit record can inject shell metacharacters, leading to arbitrary command execution. Normal CLI usage, such as `npm i -g openclaw`, is not affected as the script is not part of the shipped CLI and is not executed during routine operation.