Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local Kanban tool, but it exposes unauthenticated editing and deletion paths with unsafe deployment guidance and web security flaws that need review before installation.
Use this only as a local single-user tool on a trusted machine or behind your own authenticated reverse proxy. Do not expose port 9999 to a network until authentication, output escaping/XSS fixes, safer delete confirmations, and dependency upgrades are in place. Expect task data to remain in the Docker volume after uninstall unless you remove it manually.
src/templates/index.html:235Stored Cross-Site Scripting Through Unsanitized Task and Lane Fields
src/app.py:65Unauthenticated Destructive API Combined With Unsafe Network and Debug Deployment
sqlite-vec 0.1.1 is identified as vulnerable to a heap-based buffer overflow, which is a serious memory safety flaw. If untrusted input can reach the vulnerable code path, this could cause crashes, denial of service, or potentially memory corruption with more severe consequences depending on exploitability and environment.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
# Check MCP config
cat ~/.openclaw/config/mcp.json
# Restart MCP
openclaw gateway restart
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo ""
echo "✅ 服务已启动！"
curl -s http://localhost:9999/api/health | python3 -m json.tool || echo "⚠️ 服务正在启动，请稍后访问"
pre_uninstall: |
echo "⚠️ 停止服务..."
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo ""
echo "✅ 服务已启动！"
curl -s http://localhost:9999/api/health | python3 -m json.tool || echo "⚠️ 服务正在启动，请稍后访问"
pre_uninstall: |
echo "⚠️ 停止服务..."
The skill exposes a destructive delete capability in both REST and LLM/MCP contexts, and the documentation provides no indication of confirmation, authorization boundaries, or safeguards. In an agent-integrated system, this increases the risk of accidental or prompt-induced destructive actions, especially when tools can be invoked through natural-language workflows.
}
#### DELETE /api/projects/:id
删除项目
---
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
添加任务：
curl -X POST http://localhost:9999/api/projects \
-H "Content-Type: application/json" \
-d '{
"name": "修复登录 bug",
The LLM command endpoint accepts natural-language or tool-style input and directly executes state-changing actions, including create, update, move, and delete, with no authentication, authorization, confirmation, or dry-run step visible in this file. In this skill context, that is especially risky because an agent-facing endpoint can translate ambiguous or malicious prompts into destructive operations, making unintended deletion or tampering easier than a conventional explicit UI flow.
The batch deletion endpoint can remove multiple projects in one request with no preview, confirmation, rate limiting, or visible authorization checks. This amplifies the blast radius of mistakes or abuse, allowing a single malformed or malicious request to cause large-scale data loss.
Gunicorn 21.2.0 is flagged with multiple request smuggling advisories. If deployed behind a proxy or load balancer, request smuggling can let an attacker bypass access controls, poison request streams, or interfere with how upstream and downstream components interpret HTTP traffic.
The pinned mcp 1.0.0 dependency is reported with numerous advisories, including DNS rebinding protection issues and transport error-handling weaknesses. In an agent or MCP-exposed environment, these flaws can be especially dangerous because they may affect network trust boundaries, request validation, and server robustness when handling remote client traffic.
This markdown file is entirely written in Chinese and presents the skill security report as the default user-facing documentation without any indication that another language is available. Under the policy rule for language/locale constraints, forcing a specific language without opt-in or documented regional justification is a natural-language policy concern.
This markdown file contains user-facing policy text entirely in Chinese, but does not indicate that users may choose another language or that the locale restriction is intentional and justified. Under the natural-language policy rule, forcing a specific language without user opt-in can be a language/locale policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 添加任务 Add task
curl -X POST http://localhost:9999/api/projects \
-H "Content-Type: application/json" \
-d '{"name":"Task","lane":"feature"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This markdown file presents all user-facing content exclusively in Chinese, including headings, guidance, and safety recommendations. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale-policy issue when no alternative language option or justification is provided.
The compliance table says GDPR is only partially met because there is 'no deletion interface' at L244. However, the same document earlier states '数据删除 ✅ 支持' with support for deleting tasks/lanes at L42, creating a direct contradiction in the file's stated capabilities.
The document recommends FLASK_ENV=development, which enables a development-oriented configuration that is unsafe if copied into non-development or exposed environments. In Flask ecosystems, development mode can weaken security assumptions, increase debug exposure risk, and encourage unsafe defaults if operators reuse the snippet without understanding the boundary between dev and prod.
ports: - "127.0.0.1:9999:5000" # 仅本地 environment: - FLASK_ENV=development
### 生产环境
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The skill promotes AI analysis and vector search over task data but does not disclose what data is processed, whether it leaves the local environment, or any privacy implications. Project/task data often contains internal roadmap, personnel, or security information, so undocumented AI processing increases confidentiality risk.
The feature list explicitly states 中文命令解析, and the natural-language examples are all Chinese, with no indication that other languages are supported or that the user can opt into this locale limitation. A skill that forces a specific language without user choice can violate language/locale policy expectations.
The documentation instructs users to pull and run a mutable Docker image tagged only as latest from a placeholder registry path. Mutable tags are a supply-chain risk because the referenced image can change over time, making builds non-reproducible and allowing a compromised or swapped image to be delivered without any change to the skill itself.
No suspicious patterns detected.