ClawHub
Back to skill

Security audit

Jarvis Mission Control for OpenCLAW AIS

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill does not ship executable code, but the system it points users to has broad local agent/session access and some risky setup/reset instructions that deserve careful review.

Install only if you are comfortable auditing the linked GitHub project and running a local command-center service. Before use, review what it reads from ~/.claude/projects, restrict who can access the dashboard, avoid passing API keys directly on the command line, back up .mission-control/ before reset commands, and treat agent SOUL/MEMORY/IDENTITY edits as behavior-changing operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# Clear all tasks (keeps agent config)
rm .mission-control/tasks/*.json

# Full reset
rm -rf .mission-control/
Confidence
93% confidence
Finding
The command `rm .mission-control/tasks/*.json` can mass-delete all task records with no safety guardrails, and users may run it directly from documentation. In a command-center product managing operational state, bulk deletion of task files can disrupt workflows and destroy audit/history data.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
rm .mission-control/tasks/*.json

# Full reset
rm -rf .mission-control/
# Restart server to recreate directory structure
```
Confidence
97% confidence
Finding
The command `rm -rf .mission-control/` recursively deletes the entire application data directory, including tasks, agents, messages, queues, and logs. Because it is presented as a simple reset step in documentation, it creates a substantial risk of catastrophic irreversible data loss if copied, modified, or run from the wrong working directory.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The file explicitly says the skill is 'instruction-only' and that 'nothing executes automatically,' but the rest of the document describes capabilities involving session discovery, polling, command execution, file editing, syncing, and automatic task creation. This is dangerous because it can cause users to underestimate the operational and privacy impact of the referenced system, leading them to install or run it without informed consent or adequate review.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation states that the system auto-discovers `~/.claude/projects/` session data every 60 seconds, but it does not present this as a prominent privacy-sensitive behavior in the skill description or warnings. Access to home-directory session artifacts may expose conversation metadata, model usage, branches, and cost information, so users need explicit notice before deployment.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill advertises direct browser-based editing of `SOUL.md`, `MEMORY.md`, and `IDENTITY.md` with automatic backups, but the description does not foreground that it can modify agent configuration/state files. This is dangerous because these files may control agent behavior or contain sensitive identity and memory data, so unanticipated edits could alter agent actions, corrupt state, or expose confidential information.

Session Persistence

Medium
Category
Rogue Agent
Content
pm2 save
pm2 startup

# Or systemd — see scripts/install-service.sh
```

---
Confidence
80% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation instructs users to pass an API key directly on the command line, which can expose the secret through shell history, terminal logging, CI logs, and process listings visible to other local users or monitoring tools. Because this skill is a command center for AI systems and cloud connectivity, compromise of the API key could allow unauthorized access to the associated workspace or hosted control plane.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Register a deliverable
mc deliver "Report name" --path ./output/report.md
mc deliver "API endpoint" --url https://api.example.com/v1

# List deliverables for a task
mc deliver:list TASK-001
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Or via CLI after server is running:
```bash
curl -X POST http://localhost:3000/api/agents \
  -H "Content-Type: application/json" \
  -d '{"id":"oracle","name":"The Oracle","role":"orchestrator","status":"active"}'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The guide includes destructive reset commands that delete task data and the entire `.mission-control/` directory without explicit warnings, confirmation steps, or backup guidance. In an agent-oriented operational dashboard, users may copy-paste these commands and cause irreversible local data loss.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The Telegram integration automatically creates task cards when a message mentions an agent bot, but the documentation does not clearly warn users about this automated side effect. While the feature is not inherently malicious, insufficient disclosure can lead to unexpected task injection, spam, or workflow manipulation from external messaging inputs.

Static analysis

No suspicious patterns detected.