OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although …

摘要

OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or the first user message can place a formula-like cell in the Usage export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may be evaluated wi…

中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。