Security audit

RTS Dashboard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real OpenClaw dashboard, but it exposes private conversations and powerful Gateway controls with weak scoping and no visible authentication.

Review before installing. Run this only in a trusted local environment, assume anyone who can reach the local dashboard port may read OpenClaw conversation content or trigger Gateway actions, and prefer a version that adds authentication, strict origin checks, transcript opt-in/redaction, safer shutdown controls, input validation, and an updated ws dependency.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.js:620
Finding: Unauthenticated disclosure of agent conversations and operational metadata
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.js:682
Finding: Unauthenticated Gateway stop and restart operations
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.js:707
Finding: Unauthenticated agent-message injection through a privileged Gateway identity
Content: View full analysis
body += c); req.on('end', () => { res.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }); try { const { agent, sessionId, message } = JSON.parse(body); if (!agent || !message) { res.end(JSON.stringify({ ok: false, error: '缺少 agent 或 message' })); return; } const WsClient = require('ws'); const gwWs = new WsClient( `ws://127.0.0.1:${GATEWAY_PORT}/webchat/ws`, { origin: 'http://127.0.0.1:4320' } ); let phase = 'connecting'; gwWs.on('message', data => { try { const msg = JSON.parse(data.toString()); if ( msg.type === 'event' && msg.event === 'connect.challenge' ) { phase = 'sending-connect'; const nonce = msg.payload?.nonce || ''; const connectParams = { minProtocol: 3, maxProtocol: 3, client: { id: 'openclaw-control-ui', version: '1.0', platform: os.platform(), mode: 'webchat' }, role: 'operator', scopes: [ 'operator.admin', 'operator.read', 'operator.write' ], caps: [] }; const token = getGatewayToken(); if (token) connectParams.auth = { token }; connectParams.device = signConnectChallenge(nonce, connectParams); gwWs.send(JSON.stringify({ type: 'req', id: 'c-' + Date ...[truncated 3237 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: public/index.html:1307
Finding: Stored DOM cross-site scripting through unescaped OpenClaw metadata
Content: View full analysis
${agent.name || agent.id} ${statusText} ${isActive && session?.currentTask ? `
${truncateText(session.currentTask, 50)}
` : ''} ${isActive ? '
' : ''} `; ``` ```js const chTag = sess.channel && sess.channel !== '--' ? `·${sess.channel}` : ''; div.innerHTML = `
🖥️ ${sess.agent}${chTag}·${timeText} `; ``` ```js skillDiv.innerHTML = ` ${skill.name || skill.id} ${categoryName} `; ``` ```js const skillsList = session?.skills && session.skills.length > 0 ? session.skills .map(s => '' + s + '') .join('') : '无'; infoContainer.innerHTML = `

📋 基本信息

名称 ${agent.name || agent.id}

模型 ${agent.model || '--'}

渠道 ${session ? session.channel : '--'}

🔧 已部署技能
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server.js:630
Finding: Path traversal in the session-history file lookup
Content: View full analysis
/sessions` directory. 5. If the resulting `.jsonl` file ...[truncated 554 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a monitoring dashboard, but the analysis indicates additional sensitive behaviors: gateway stop/restart actions, local credential generation/storage, and exposure of full session history and messages. This mismatch is dangerous because users may authorize a seemingly read-only dashboard without realizing it has control-plane actions and access to sensitive conversation data.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
- **Right panel**: System vitals (CPU/RAM), gateway status, event logs, selected target details - **Agent detail**: Model, current task, deployed skills, recent conversation - **Skill detail**: Description, use cases, related agents - **Chat bar**: Send messages to agents via Gateway WebSocket `chat.send` RPC - **Cron jobs**: Display scheduled tasks with status on the map - **5-min cooldown**: Agents remain visible for 5 minutes after going offline (amber blink + countdown) - **CRT scan line + radar sweep + grid**: Full military-UI aesthetic

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The lockfile pins the skill to ws 8.20.0, and the supplied finding identifies published vulnerabilities affecting that exact version: uninitialized memory disclosure and memory-exhaustion denial of service. Because this skill exposes a browser-based real-time dashboard and uses WebSocket messaging for live monitoring/chat, a vulnerable WebSocket library is directly in the attack path and could allow remote clients or upstream peers to crash the service or potentially leak process memory.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The package references ws 8.20.0, which is flagged with advisories for uninitialized memory disclosure and memory-exhaustion denial of service. Given this skill is a browser-based monitoring dashboard that explicitly uses WebSocket functionality for real-time updates and chat messaging, an exposed or reachable WebSocket endpoint increases the likelihood that these issues could be triggered remotely against the service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Shutdown and restart capabilities are not justified by the stated purpose of a visual RTS-style monitoring dashboard and materially increase risk. In this context, the mismatch makes the feature more dangerous because users may not expect destructive controls in a monitoring tool, increasing the chance of misuse or social engineering-driven clicks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The UI includes gateway restart and shutdown controls even though the skill is presented as a monitoring and visualization dashboard. This is dangerous because it expands the skill from passive observability into active administrative control, enabling service disruption or accidental operational changes from a page the user may reasonably trust as read-only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The client issues POST requests to administrative endpoints for gateway mutation actions, which are outside the documented monitoring scope. This creates a hidden privilege boundary issue: a dashboard user can trigger backend state changes, including stopping the gateway, causing denial of service or unauthorized operational impact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code reads session .jsonl files, extracts recent user and assistant messages, and includes them in the dashboard state returned over HTTP/WebSocket. That goes beyond operational monitoring metadata and exposes potentially sensitive conversation content from other sessions to anyone who can access the dashboard service.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code collects recent user and assistant messages from session logs and emits them in plain text as part of the live session objects. This is sensitive data disclosure because the dashboard becomes a passive transcript viewer for potentially private prompts, outputs, and embedded secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The service exposes sensitive session content through HTTP/WebSocket interfaces without any visible warning, consent flow, or disclosure that conversation data will be shown. In a monitoring tool, silent exposure of message content increases the likelihood of inadvertent privacy violations and unauthorized observation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The /api/session-history endpoint returns full chat transcripts by reading raw session logs and serializing user/assistant content back to the client. This creates a direct data-exfiltration path for conversation history that is inconsistent with a dashboard described as a monitoring UI.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: By returning complete message transcripts from session log files, the endpoint discloses user-provided content and assistant responses in full. This can leak secrets, personal data, proprietary prompts, or internal operational context to any caller who can access the dashboard.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This endpoint returns complete transcripts without any access warning, consent checkpoint, or narrowing to metadata-only views. That materially increases privacy and confidentiality risk because operators may retrieve full user content from arbitrary sessions with no friction or safeguards.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The POST endpoints can stop or restart the OpenClaw gateway by invoking subprocess commands, with no authentication or authorization checks visible in this server. Any local webpage or script able to reach the service could trigger disruption of the platform's control plane.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · server.js (reported line 765)May include surrounding context.
js
return; } phase = 'connected'; // Now send chat message const sessionKey = sessionId ? `agent:${agent}:${sessionId}` : `agent:${agent}:main`; const chatId = 'm-' + Date.now(); const idempotencyKey = 'rts-' + Date.now() + '-' + Math.random().toString(36).substring(2, 8);

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The primary descriptive content is presented in Chinese, and the README does not indicate that other language options are available. This can violate a language/locale policy when users are not given a choice or warned that the skill documentation is language-specific.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to use environment-dependent behavior and to start services, install packages, and read configuration, but it declares no explicit tool scope or permission boundaries. This increases the chance the skill is invoked with broader-than-necessary capabilities, making unintended filesystem, process, and configuration access more likely.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation guidance is broad enough that common user requests to 'open' or 'launch' a dashboard could trigger package installation, background process creation, and service startup. Overbroad activation raises the risk of the agent taking impactful actions without the user understanding that software will be installed or a persistent service started.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The stop instruction forcefully terminates any process bound to port 4320 without warning, ownership checks, or graceful shutdown. This can kill unrelated processes and cause data loss or service disruption, especially if another application is using that port.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill states that it generates and stores device keys locally for authentication but provides no user-facing warning or consent flow. Silent creation of persistent credentials can expand trust relationships and leave sensitive authentication material on disk without the user's informed approval.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
- On first launch, generates a keypair and saves to `.device-keys.json` - Signs each `connect.challenge` nonce using v3 protocol - Gateway token is auto-discovered from `OPENCLAW_GATEWAY_TOKEN` env var or `gateway.auth.token` in `openclaw.json` - Localhost connections are auto-approved by Gateway (no manual pairing needed) - **No `dangerouslyDisableDeviceAuth` or `allowInsecureAuth` required** ## Cross-Platform

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document declares lang="zh-CN", and the visible UI text and time formatting are consistently fixed to Chinese/China locale. The policy requires flagging language or locale constraints when they are forced without user opt-in, and this file does not offer any language selection or explain that the skill is region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The dashboard retrieves and displays session chat history and allows message sending without any visible disclosure about sensitivity, retention, or operator access. This is risky because conversation content may contain secrets or private data, and the UI normalizes access to that content without warning or access-scoping cues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The gateway control flow performs destructive backend actions with lightweight inline confirmation but no robust safeguard such as re-authentication, typed confirmation, or permission checks visible in the client. That makes accidental or coerced shutdown/restart easier, especially in a tool framed primarily as a dashboard.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill generates and persists a device private key used for gateway operator authentication in a local JSON file. While not inherently malicious, storing long-lived operator credentials on disk increases the attack surface: compromise of the dashboard host or file permissions could let an attacker impersonate an operator to the gateway.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: server.js:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: server.js:110