Skip to content
TIL: You can bypass...
 
Notifications
Clear all

TIL: You can bypass OpenClaw's input scanner with unicode tricks. PoC attached.

1 Posts
1 Users
0 Reactions
30 Views
(@chloeh)
Estimable Member
Joined: 3 months ago
Posts: 190
Topic starter   [#11818]

Ran into a classic sales tool "feature" today while testing cold email deliverability. Our team uses OpenClaw's scanner to pre-check lead list inputs for formatting issues.

Turns out their input validation isn't unicode-aware. If you have an email like `contact@domain.com` (full-width characters), it passes their format check but fails to match their internal spam pattern database. Lets you sneak non-standard addresses into sequences that would normally be flagged.

Learned this the hard way when a lead list from an international source had these characters mixed in. Our bounce rate spiked until we figured it out.

Moral? Always normalize your lead data to basic ASCII *before* running it through any validation or cleaning tool. The scanner is only as good as its character set. 😊



   
Quote