Security audit

Openclaw Vercel Insights

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only Vercel observability helper, but users should understand that account-scoped tokens can expose broad analytics, metrics, and log data.

Install only if you are comfortable giving the skill a Vercel read token with the needed account or team scope. Prefer an environment or secrets-provider reference over storing the token in plaintext, use the narrowest read scope that still answers your questions, and treat request logs as sensitive because application logs may contain customer data or secrets that this skill cannot generally redact.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The README explicitly documents `--list-metrics` and arbitrary `--metric` queries that can enumerate and read many observability metrics beyond the skill metadata's stated scope of errors, traffic, and speed. This creates a capability/scope mismatch: users and orchestrators may grant trust based on the narrower description while the skill can access a much broader account-wide telemetry surface, including functions, firewall, caching, and AI gateway metrics.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The code explicitly permits arbitrary observability metric IDs matching `vercel.<namespace>.<metric>` via `_OTHER_METRIC_ID_RE` and `_generic_metric`, bypassing the manifest's apparent Speed Insights-only scope. In a read-only skill this is not arbitrary code execution, but it does expand the data-access surface to potentially unrelated account telemetry, violating least privilege and creating a scope-mismatch risk if callers can influence `--metric`.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: `format_schema()` renders all queryable metrics returned for the current account scope, optionally filtered only by a caller-supplied prefix, which can reveal observability capabilities beyond speed/traffic/error data described in the skill metadata. In a multi-project/team context, this can disclose the existence and naming of additional telemetry sources and broaden reconnaissance value for anyone with access to invoke the skill.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The trigger phrases are broad enough that the skill could be invoked on vague requests such as 'show me the logs' or 'how is my traffic this week' without the user intending to expose sensitive runtime logs or account-level observability data. In this context, unintended invocation matters because the skill can access request logs and account-scoped analytics using a high-value Vercel token.

Static analysis

No suspicious patterns detected.