Security audit

vizclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but it tells users to run mutable remote code and streams detailed agent content to VizClaw by default, so it needs careful review before installation.

Install only if you are comfortable sending OpenClaw run content to VizClaw. Prefer overview mode for normal use, avoid streaming secrets or private project data, do not run the remote uv URL unless you trust that live hosted script, and prefer pinned/reviewed local versions where available.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:17
Finding: Execution of Mutable Python Code from a Remote URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/connect.py:1069
Finding: Sensitive OpenClaw Content Is Transmitted to an External Service by Default
Content: View full analysis
str | None: if not text: return None return text if mode == "detailed" else None ``` ```python async for evt in event_iter: # Filter by run_id if specified if run_id: evt_run = first_str( evt, "runId", "run_id", "agentId", "agent_id", "id", ) inner = evt.get("payload") if isinstance(inner, dict): evt_run = evt_run or first_str( inner, "runId", "run_id", "agentId", "agent_id", ) if evt_run and evt_run != run_id: continue mapped = map_openclaw_event( evt, session_id, model, mode, quiet_mode=quiet_mode ) for payload in mapped: payload["timestamp"] = now_iso() await client.send(payload, reliable=True, remember=True) ``` ```python async def send(self, payload: dict, reliable: bool = True, remember: bool = True): data = dict(payload) if reliable and not data.get("clientEventId"): data["clientEventId"] = self.next_client_event_id() if remember and reliable and data.get("type") != "heartbeat": self.replay_buffer.append(data) attempts = 0 while True: attempts += 1 try: await self.ensure_connected() await self._send_and_wait_ack(data, timeout_seconds=6 if reliable else 3) return except Exception as err: if attempts >= 5: raise err print(f"[vizclaw] send failed (attempt {attempts}), reconnecting...", file=sys.stderr) await self.reconnect() ``` ```python parser.add_argume ...[truncated 3121 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unpinned Runtime and Installation Dependencies
Content: View full analysis
=3.10" # dependencies = ["websockets"] # /// ``` ### Technical Analysis The installation command explicitly requests `clawhub@latest`, while the inline Python metadata requests `websockets` without an exact version or integrity hash. This makes installation and execution non-reproducible: the package versions resolved in a future run can differ from those evaluated during the audit. The evidence does not establish that either upstream package is currently malicious. The security issue is that the Skill trusts mutable, unpinned supply-chain components, allowing compromised or unexpectedly changed releases to become part of the execution path without a corresponding change to this repository. ### Attack Path 1. An upstream package account, release pipeline, registry entry, or dependency is compromised. 2. A malicious or vulnerable release becomes the version selected by `@latest` or the unconstrained `websockets` requirement. 3. A user installs or runs the Skill after that release is published. 4. The package manager retrieves the newly selected component. 5. Malicious installation or runtime code executes with the invoking user's permissions, or an incompatible update weakens connection security and event handling. ### Impact Assessment A compromised executable dependency could run with the privileges of the user installing or invoking the Skill. Potential exposure includes project files, event streams, network access, and user-level credentials available to the process. The exact impact depends on the compromised dependency and package-manager behavior. Unlike the direct remote-script execution issue, exploitation ...[truncated 107 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable commands that fetch and run remote code and stream agent events, but it does not declare an explicit tool scope such as network or file access permissions. That makes the capability boundary unclear to users and tooling, increasing the chance that the skill is installed or trusted without understanding that it can read local inputs and transmit data off-host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using 'npx clawhub@latest install vizclaw' relies on an unpinned, mutable package version, so future installs may execute different code than was originally reviewed. In a security-sensitive context, this creates a supply-chain risk: a compromised publisher, dependency, or registry response could cause arbitrary code execution during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The OpenClaw gateway token is inserted into the WebSocket query string while also being sent as an Authorization header. Query-string credentials are commonly exposed through logs, proxies, browser/history-style telemetry, exception messages, and server access logs, increasing the chance of credential leakage beyond the intended recipient.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script forwards queries, agent reports, tool usage, and other event content to remote VizClaw endpoints by default, but the CLI UX does not prominently warn users that potentially sensitive prompts, logs, and agent output will leave the local system. In this skill context, that matters because the tool is explicitly designed as a bridge for OpenClaw runs and log streams, which may contain secrets, internal code, or operational data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/connect.py (reported line 1439)May include surrounding context.
python
parser = argparse.ArgumentParser(description="VizClaw Connect") parser.add_argument("--hub", default="wss://api.vizclaw.com/ws/report", help="WebSocket hub URL") parser.add_argument("--api", default="https://api.vizclaw.com/api/report", help="HTTP API URL") parser.add_argument("--model", default="opus", help="Model name") parser.add_argument("--mode", default="detailed", help="detailed | overview | hidden") parser.add_argument("--trigger-source", default="human", help="human | cron | heartbeat")

Static analysis

No suspicious patterns detected.