Overkill Mission Control

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:36 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed mission-control dashboard, but it asks to install persistent system services and remotely expose an agent-control interface with root-level service configuration and little security scoping.

Review carefully before installing. Only use this on a machine where you are comfortable running a persistent OpenClaw control dashboard, and do not enable Tailscale exposure until access controls, allowed users, authentication, logs, and uninstall/disable steps are clear. The localhost curl examples are not exfiltration evidence, but the persistent root-level proxy service and autonomous execution endpoints deserve administrator review.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:21
• Finding: Persistent System-Wide Services for Dashboard and Network Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–31 and 123–154 **Vulnerability Type**: System-wide service persistence **Risk Level**: Critical ### Vulnerable Code ```json { "id": "service", "kind": "systemd", "label": "Create Mission Control systemd service", "path": "/etc/systemd/system/mission-control.service" }, { "id": "tailscale", "kind": "systemd", "label": "Create Tailscale proxy service", "path": "/etc/systemd/system/tailscale-serve.service" } ``` ```ini [Unit] Description=Mission Control Dashboard After=network.target [Service] Type=simple User=broedkrummen WorkingDirectory=/home/broedkrummen/.openclaw/workspace-mission-control ExecStart=/usr/bin/npm run dev Restart=always [Install] WantedBy=multi-user.target ``` ```ini [Unit] Description=Tailscale Serve for Mission Control After=network.target tailscaled.service [Service] Type=simple User=root ExecStart=/usr/bin/sudo /usr/bin/tailscale serve 3000 Restart=always [Install] WantedBy=multi-user.target ``` ### Technical Analysis The installation metadata requests creation of two system-wide systemd unit files under `/etc/systemd/system`. Both services specify `Restart=always` and an installation target of `multi-user.target`. If enabled, these settings cause the dashboard and Tailscale proxy to operate independently of the original skill invocation, restart after process failure, and start during subsequent system boots. This creates a cross-session persistence mechanism. The persistent dashboard is described as providing access to agent messaging, task execution, documents, automation workflows, runbooks, and system metrics. Persistently exposing such an interface through Tailscale increases the consequences of weak application authentication, authorization defects, or compromise of a permitted Tailscale identity. The underlying application implementation was absent from the audited artifact, so its access controls could not be verified. ### Attack ...[truncated 1186 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create or enable system-wide services automatically during skill installation. 2. Run the dashboard as an explicitly started, unprivileged user process by default. 3. Require informed administrator approval before installing any persistent service. 4. Bind the dashboard to localhost unless remote access is explicitly required. 5. Require strong authentication and authorization before enabling remote access. 6. Use a production server configuration rather than persistently running `npm run dev`. 7. If systemd operation is necessary: - Use a dedicated, minimally privileged service account. - Apply `NoNewPrivileges=true`. - Apply `PrivateTmp=true`. - Use `ProtectSystem=strict` and `ProtectHome=true` where compatible. - Restrict writable paths with `ReadWritePaths=`. - Limit network access with appropriate systemd controls. - Define explicit stop, disable, and uninstall procedures. 8. Log service creation, activation, remote exposure, and access events. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:143
• Finding: Tailscale Proxy Service Executes with Unnecessary Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 143–149 **Vulnerability Type**: Excessive service privileges **Risk Level**: High ### Vulnerable Code ```ini [Service] Type=simple User=root ExecStart=/usr/bin/sudo /usr/bin/tailscale serve 3000 Restart=always ``` ### Technical Analysis The Tailscale proxy service is explicitly configured to run as `root`. It then invokes `sudo`, even though the service already has root privileges. This is redundant and violates least-privilege principles. Any vulnerability in the invoked executable, its runtime dependencies, or a privileged configuration path would execute within a root service context. The fixed absolute executable paths reduce PATH-based command substitution risk, but they do not justify granting the complete service root privileges. Because the artifact contains only documentation and installation metadata, no direct root-code-execution vulnerability in Tailscale or `sudo` was established. The confirmed issue is the unnecessary creation of a persistent, root-level execution context. ### Attack Path 1. The systemd unit is installed and enabled with administrative privileges. 2. systemd starts the unit under the `root` account. 3. The root-owned service invokes `/usr/bin/sudo`, which launches `/usr/bin/tailscale serve 3000`. 4. The proxy persistently exposes the dashboard through Tailscale. 5. If the trusted executable, its configuration, or another component in this privileged execution path is compromised, attacker-controlled behavior executes with the service's root privileges. 6. `Restart=always` causes the privileged process to be relaunched after termination or failure. ### Impact Assessment The service receives root-level access to the host rather than only the permissions needed to publish the dashboard. A compromise of the privileged execution path could affect the entire machine, including system configuration, services, files, network settings, and data belonging to ...[truncated 193 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `User=root` and run the service under a dedicated, non-login account. 2. Remove the redundant `/usr/bin/sudo` invocation. 3. Grant only the specific Linux capabilities or Tailscale permissions required for the operation. 4. Prefer configuring Tailscale Serve through an administrator-approved, one-time command rather than maintaining an unrestricted root service. 5. Add systemd hardening controls, including: - `NoNewPrivileges=true` - `ProtectSystem=strict` - `ProtectHome=true` - `PrivateTmp=true` - `PrivateDevices=true` - `RestrictSUIDSGID=true` - `LockPersonality=true` - `CapabilityBoundingSet=` with only required capabilities 6. Require explicit administrator confirmation before exposing port 3000. 7. Restrict access to authorized Tailscale identities and verify that the dashboard independently enforces authentication and authorization. 8. Pin and verify the trusted executable and review its configuration and update process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent

Content

{
              "id": "service",
              "kind": "systemd",
              "label": "Create Mission Control systemd service",
              "path": "/etc/systemd/system/mission-control.service"
            },
            {

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation encourages exposing the dashboard via Tailscale and advertises webhook/HTTP automation, but provides no warning about authentication, sensitive data exposure, or the risk of remote triggering. Because this dashboard appears to control agents, messages, documents, and automation, remote exposure without explicit security guidance can lead users to deploy an internet-reachable control plane unsafely.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes polling and execution endpoints that can trigger autonomous operations, including executing tasks based on message content, but does not warn that these actions may cause real side effects. In a mission-control product, undocumented autonomous execution is especially dangerous because users may invoke endpoints or enable polling without understanding they can drive agents to act on external or queued input.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs creation of a root-level Tailscale proxy service for a dashboard, which expands exposure beyond the stated local dashboard function and grants network publication capability under root. In the context of a mission-control interface with agent messaging, task execution, documents, and webhooks, externally exposing the service materially increases attack surface and the blast radius of any app flaw or misconfiguration.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

[Service]
Type=simple
User=root
ExecStart=/usr/bin/sudo /usr/bin/tailscale serve 3000
Restart=always

[Install]

• Confidence: 97% confidence
• Finding: The service is configured to run as root and invokes sudo in ExecStart to publish the dashboard via Tailscale. Running a network-exposed helper as root violates least-privilege principles and increases the consequences of command misuse, service compromise, or future modifications to the service definition.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Dashboard not loading
```bash
# Check if server is running
curl http://localhost:3000

# Restart server
sudo systemctl restart mission-control

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl http://localhost:3000

# Restart server
sudo systemctl restart mission-control
```

### Tailscale not working

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl http://localhost:3000

# Restart server
sudo systemctl restart mission-control
```

### Tailscale not working

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.