ClawHub
Back to skill

Security audit

Glance

Security checks for vulnerabilities and agentic risk

Overview

This dashboard skill has a coherent purpose, but it gives agents broad scheduled command execution and credential reuse paths that need careful review before installation.

Install only if you want OpenClaw to manage an always-on local dashboard and you are comfortable granting it scheduled local command execution and access to selected credentials. Prefer manual or verified installation over curl-to-bash, do not paste broad personal access tokens into chat, use least-privilege read-only tokens, review imported widget packages before enabling refresh schedules, and disable background services or cron refreshes you do not need.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:553
Finding

Imported Widget Instructions Are Automatically Executed by Tool-Enabled Subagents

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:45
Finding

Mutable Remote Installation Scripts Are Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:70
Finding

Dashboard Installation Creates an Automatically Restarting Login Service

Content
View full analysis
~/Library/LaunchAgents/com.glance.dashboard.plist << 'EOF' Label com.glance.dashboard ProgramArguments /opt/homebrew/bin/npm run dev WorkingDirectory ~/.glance RunAtLoad KeepAlive StandardOutPath ~/.glance/logs/stdout.log StandardErrorPath ~/.glance/logs/stderr.log EOF mkdir -p ~/.glance/logs launchctl load ~/Library/LaunchAgents/com.glance.dashboard.plist launchctl start com.glance.dashboard ``` README additionally recommends persistent service scripts: ```bash cd ~/.glance ./scripts/install-launchd.sh ``` and: ```bash cd ~/.glance ./scripts/install-systemd.sh ``` ### Technical Analysis `RunAtLoad` causes the dashboard to start automatically when the user logs in, while `KeepAlive` causes launchd to restart it after termination. The Linux instructions similarly register a user-level systemd service. Persistent operation can be useful for an explicitly requested always-on dashboard. It is not necessary for the minimum functionality of creating or previewing widgets, which can operate through a foreground process. The persistent service continuously exposes application code, server endpoints, dependency code, and scheduled refresh functionality beyond the initiating session. The README-referenced ins ...[truncated 1235 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
README.md:207
Finding

Agent-Held Credentials Are Reused and Copied Without Explicit Per-Secret Authorization

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (65)

Context-Inappropriate Capability

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The agent_refresh workflow explicitly instructs the agent to spawn subagents and execute local shell commands, then push results back to the service. This turns a widget-management skill into a general-purpose host execution and automation pathway, enabling indirect command execution and persistence-like behavior through recurring refresh tasks.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The README recommends piping a remotely fetched script directly into bash, which prevents inspection and gives the remote host immediate code execution on the user's machine. In a skill ecosystem where users may trust agent-provided setup steps, this materially increases supply-chain and remote compromise risk if the server, DNS, or distribution path is tampered with.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

Option A: One-Line Install (Recommended)

bash
curl -fsSL https://openglance.dev/install.sh | bash

This will:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The command chaining of a network fetch directly into a shell is dangerous because it turns untrusted remote content into immediate executable input with no validation step. This is especially risky in AI-agent contexts where commands may be repeated automatically or suggested to less technical users without scrutiny.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

Option A: One-Line Install (Recommended)

bash
curl -fsSL https://openglance.dev/install.sh | bash

This will:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
npm install

# Configure environment
cp .env.example .env.local
# Edit .env.local with your settings

# Start development server

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
npm install

# Configure environment
cp .env.example .env.local
# Edit .env.local with your settings

# Start development server

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
{
      "id": "github",
      "type": "api_key",
      "name": "GitHub Personal Access Token",
      "description": "Token with repo scope",
      "obtain_url": "https://github.com/settings/tokens"
    }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 755)May include surrounding context.

md
{
      "id": "github",
      "type": "api_key",
      "name": "GitHub Personal Access Token",
      "description": "Token with repo scope",
      "obtain_url": "https://github.com/settings/tokens"
    }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · widget-sdk.md (reported line 2600)May include surrounding context.

md
{
      "id": "github",
      "type": "api_key",
      "name": "GitHub Personal Access Token",
      "description": "Token with repo scope",
      "obtain_url": "https://github.com/settings/tokens"
    }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The skill instructs the agent to issue a DELETE request to mark refresh requests as processed using a slug parameter that originates from workflow state. Without strong validation and authorization boundaries, such state-changing tool calls can be abused to clear or manipulate work items, especially when paired with broad invocation and DB-driven instructions.

Content

Scanner excerpt · SKILL.md (reported line 911)May include surrounding context.

md
7. **credentials is REQUIRED** — use empty array `[]` if no credentials needed
8. **Don't wrap in Card** — the framework provides the outer card, you render content only
9. **Use Haiku for refresh subagents** — mechanical data collection doesn't need Opus
10. **Mark refresh requests as processed** — `DELETE /api/widgets/{slug}/refresh` after handling
11. **Spawn subagents for refreshes** — don't block main session with PTY/long-running work

## Environment Variables

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · dashboard-api.md (reported line 14)May include surrounding context.

md
- [GET /api/dashboard](#get-apidashboard)
  - [POST /api/dashboard](#post-apidashboard)
  - [PATCH /api/dashboard/:instanceId](#patch-apidashboardinstanceid)
  - [DELETE /api/dashboard/:instanceId](#delete-apidashboardinstanceid)
  - [PUT /api/dashboard/layout](#put-apidashboardlayout)
- [Grid System](#grid-system)
- [Auto-Placement](#auto-placement)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · dashboard-api.md (reported line 169)May include surrounding context.

md
---

### DELETE /api/dashboard/:instanceId

Remove a widget from the dashboard.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 313)May include surrounding context.

md
"Are you sure you want to delete the weather widget?"

2. DELETE WIDGET INSTANCE (removes from dashboard)
   DELETE /api/widgets/instances/:id
   → Returns { "success": true }

3. OPTIONALLY DELETE WIDGET DEFINITION (removes the code)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 1448)May include surrounding context.

md
"Are you sure you want to delete the weather widget?"

2. DELETE WIDGET INSTANCE (removes from dashboard)
   DELETE /api/widgets/instances/:id
   → Returns { "success": true }

3. OPTIONALLY DELETE WIDGET DEFINITION (removes the code)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 317)May include surrounding context.

md
→ Returns { "success": true }

3. OPTIONALLY DELETE WIDGET DEFINITION (removes the code)
   DELETE /api/widgets/:slug
   → Returns { "success": true, "deleted_id": "cw_xxx" }

4. CONFIRM

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 531)May include surrounding context.

md
→ Returns { "success": true }

3. OPTIONALLY DELETE WIDGET DEFINITION (removes the code)
   DELETE /api/widgets/:slug
   → Returns { "success": true, "deleted_id": "cw_xxx" }

4. CONFIRM

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 1455)May include surrounding context.

md
→ Returns { "success": true }

3. OPTIONALLY DELETE WIDGET DEFINITION (removes the code)
   DELETE /api/widgets/:slug
   → Returns { "success": true, "deleted_id": "cw_xxx" }

4. CONFIRM

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill asks for a GitHub personal access token and instructs the agent to collect it via conversation. Requesting and then storing powerful credentials materially raises the risk of secret exposure and unauthorized downstream API access if the chat channel, logs, or prompt context are compromised.

Content

Scanner excerpt · widget-sdk.md (reported line 332)May include surrounding context.

md
→ Check if provider "github" exists in credentials list

2. EXPLAIN TO USER
   "I need a GitHub personal access token to show your PRs.
    You can create one at https://github.com/settings/tokens
    with the 'repo' scope. Paste it here when ready."

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · widget-sdk.md (reported line 684)May include surrounding context.

Delete a Credential

http
DELETE /api/credentials/:id
Authorization: Bearer <token>

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section expands the skill from dashboard/widget management into agent-machine capability checks and use of local CLI authentication. That creates a privilege boundary crossing: a user request about widgets can induce the agent to inspect or depend on host-side tools and auth state, which is substantially more dangerous than normal API-only widget operations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

This guidance normalizes requesting a GitHub token directly from the user when a check fails. In the context of an AI agent, that encourages credential acquisition through an unsafe channel and can train users to divulge secrets conversationally.

Content

Scanner excerpt · widget-sdk.md (reported line 783)May include surrounding context.

if (!status.github?.configured) { // Prompt user for GitHub token throw new Error( "GitHub token required. Please provide your GitHub personal access token.", ); }

text

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · widget-sdk.md (reported line 1261)May include surrounding context.

md
- Make authenticated API calls without exposing credentials to the browser
- Process or transform data before sending to the client
- Access credentials securely via `getCredential()`

### Writing Server Code

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · widget-sdk.md (reported line 1481)May include surrounding context.

md
<div className="text-center">
            <p className="font-medium">GitHub token required</p>
            <p className="text-sm text-muted-foreground">
              Add your GitHub personal access token in Settings → Credentials
            </p>
          </div>
        </CardContent>

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The integration guide asks the user to paste a personal access token into chat and promises to store it securely. Even if storage is secure, the collection channel is not, creating risk of transcript leakage, prompt retention, or accidental re-exposure by the agent.

Content

Scanner excerpt · widget-sdk.md (reported line 1994)May include surrounding context.

If a required credential is missing, ask the user to provide it:

text
Agent: "I need a GitHub personal access token to show PR data.
You can create one at https://github.com/settings/tokens with 'repo' scope.
Once you have it, just paste it here and I'll store it securely."

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The import flow directs the agent to register cron jobs and operational automations on the agent side after widget import. That introduces durable background execution from imported content, so a shared widget package can cause ongoing agent activity beyond the immediate user request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is presented as natural-language driven with no clear activation guardrails, encouraging an agent to infer use from loosely related requests. Because the skill manages dashboard state and sensitive integrations, unconstrained invocation can lead to unintended API calls, widget creation, or storage of secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.