Task Dispatch

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent task-board dispatcher, but it gives agents recurring authority to run subagents, change task-board state, execute an unpinned remote installer, and copy access tokens into workspace files.

Install only if you trust the ClawBoard source and task authors, and prefer using a reviewed pinned release, a least-privilege token, protected secret storage, and manual approval for tasks that request network access, credential access, package installation, persistence, or work outside the intended project.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:222

Finding

Untrusted task-board content is converted into executable subagent instructions

Content

View full analysis

", "timeoutSeconds": 300 } ``` The main agent should: 1. Fill dispatch template with task context 2. Spawn subagent with the template 3. **Wait for completion** (blocking or polling) 4. Parse `completion_signal` from response 5. Verify deliverables and update status 6. **Immediately continue to next task** ``` The related integration instructions state: ```markdown 1. 从任务数据提取字段 2. 填充模板 3. 调用 `sessions_spawn`，将模板内容作为 `task` 参数 4. 等待 subagent 完成 5. 解析 `completion_signal` 6. 根据状态更新任务 ``` ### Technical Analysis Task titles, descriptions, context, deliverables, acceptance criteria, and paths originate from the task-board API. These fields cross from an external data source into a tool-capable subagent prompt without a defined trust boundary. The Skill does not require: - Treating task fields strictly as quoted data. - Rejecting embedded instructions or prompt-control text. - Restricting requested paths to an approved project root. - Allowlists for subagent tools and operations. - Human approval for access to credentials, external networks, or unrelated ...[truncated 1847 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:54

Finding

Board access token is duplicated into Agent workspace files without secure handling

Content

View full analysis

> ~/.openclaw/workspace-/.env echo "TASKBOARD_ACCESS_TOKEN=$TOKEN" >> ~/.openclaw/workspace-/.env ``` ### Technical Analysis The board token is read from `~/ClawBoard/.env` and copied in plaintext into another `.env` file. Although board authentication is necessary for dispatching, persistent duplication into an Agent workspace is broader than the minimum privilege required. The instructions do not: - Create the destination with mode `0600`. - Check the ownership or permissions of the workspace or existing `.env`. - Validate or canonicalize the substituted workspace name. - Prevent symbolic-link traversal at the destination. - Replace existing variables atomically. - Prevent duplicate or stale token entries. - Issue a separate token scoped only to required read/update operations. - Prevent delegated subagents and workspace tools from reading the copied token. The use of `grep` and `cut` is also not robust `.env` parsing. Multiple matching entries, whitespace, comments, or values containing `=` can produce an incorrect value. Append mode can retain old credentials and create ambiguous configuration. ### Attack Path 1. The user follows the setup instructions. 2. The shell reads `BOARD_ACCESS_TOKEN` from `~/ClawBoard/.env`. 3. The token is appended to an Agent workspace `.env` file. 4. A subagent, plugin, local process, backup service, or user with access to that workspace reads the file. 5. The recovered bearer token is used against the ClawBoard API. 6. Based on the token's server-side permissions, the attacker reads projects and tasks, creates tasks, changes task status, or injects mal ...[truncated 867 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25

Finding

Mutable remote repository is downloaded and executed without integrity verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md

# Task Dispatch Skill

任务调度技能，让 Agent 能够自动检查任务看板、派发任务给 subagent 执行、验收结果并更新状态。

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill extracts a bearer token from one application’s .env file and copies it into another workspace’s .env file, broadening credential exposure across trust boundaries. This creates unnecessary credential proliferation, increases the chance of token leakage via logs/files/workspace sharing, and normalizes secret handling that exceeds the skill’s stated dispatch purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Reading BOARD_ACCESS_TOKEN from ~/ClawBoard/.env is direct credential extraction from a secret-bearing file. In this skill, the extracted token is then propagated for reuse, making the act more dangerous because it facilitates unauthorized API access if the workspace, shell history, or subsequent commands are exposed.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash

# 获取 token
TOKEN=$(cat ~/ClawBoard/.env | grep BOARD_ACCESS_TOKEN | cut -d= -f2)

# 写入 Agent 工作目录
echo "TASKBOARD_API_URL=http://127.0.0.1:3000" >> ~/.openclaw/workspace-<name>/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Appending task board API configuration into another workspace’s .env file is credential material propagation into a secondary storage location. Even though the URL itself is not secret, placing it adjacent to secret material as part of automated credential setup contributes to insecure secret management patterns and broadens the footprint of sensitive configuration.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

TOKEN=$(cat ~/ClawBoard/.env | grep BOARD_ACCESS_TOKEN | cut -d= -f2)

写入 Agent 工作目录

echo "TASKBOARD_API_URL=http://127.0.0.1:3000" >> ~/.openclaw/workspace-/.env echo "TASKBOARD_ACCESS_TOKEN=$TOKEN" >> ~/.openclaw/workspace-/.env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line writes the extracted bearer token into a workspace .env file in plaintext, creating a durable copy of a sensitive credential outside its original trust boundary. If that workspace is shared, backed up, inspected by tools, or later exfiltrated, the token can be reused to access the task board API.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

写入 Agent 工作目录

echo "TASKBOARD_API_URL=http://127.0.0.1:3000" >> ~/.openclaw/workspace-/.env echo "TASKBOARD_ACCESS_TOKEN=$TOKEN" >> ~/.openclaw/workspace-/.env

text

### Step 5: 打开看板

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

| Command | Description |
|---------|-------------|
| `./clawboard install` | Install dependencies, create .env |
| `./clawboard start` | Start frontend + backend services |
| `./clawboard stop` | Stop all services |
| `./clawboard status` | Check service health |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

| Command | Description |
|---------|-------------|
| `./clawboard install` | Install dependencies, create .env |
| `./clawboard start` | Start frontend + backend services |
| `./clawboard stop` | Stop all services |
| `./clawboard status` | Check service health |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

| `./clawboard start` | Start frontend + backend services |
| `./clawboard stop` | Stop all services |
| `./clawboard status` | Check service health |
| `./clawboard token` | Show current access token |
| `./clawboard token --generate` | Generate new token |

### Verification Checklist

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes automated dispatch, execution, acceptance, and task-state transitions on an external task board, but it does not clearly warn users that enabling the skill will cause persistent changes to external system data. In an agent context, hidden or insufficiently disclosed side effects increase the risk of unintended modifications, especially when the skill can run continuously and act without per-task user confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

创建可自动派发的任务

bash

curl -X POST http://127.0.0.1:3000/api/tasks/projects/{projectId}/tasks \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is written as specific Chinese-language utterances such as 用户说"设置任务调度"或"部署 ClawBoard"时, which implies a required locale for invocation. The file does not offer multilingual alternatives or state that the skill is intentionally limited to Chinese-speaking users for a documented reason.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

node --version # 需要 >= 18

检查 ClawBoard 是否已安装

ls -la ~/ClawBoard 2>/dev/null || echo "ClawBoard not installed"

text

### Step 2: 部署 ClawBoard（如未安装）

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s declared purpose is task dispatching, but it also directs full local deployment of ClawBoard, including cloning a repository, installing dependencies, starting services, and configuring credentials. This expands the operational scope far beyond dispatch logic and increases attack surface by enabling system changes and execution of unvetted external code under the guise of a scheduling skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The deployment section performs meaningful system changes—repository download, dependency installation, service startup, and token generation—without clearly warning the user that code will be executed and local services modified. In a skill context, missing safety prompts materially increases the risk of unintended or socially engineered host changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions authorize cloning a third-party repository and running its installer/startup commands even though the skill’s role says the agent is only a dispatcher. That mismatch can be abused to cause unauthorized code execution, package installation, process creation, and persistent system modification in environments where a user expected only task-board orchestration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs writing sensitive API credentials into a local agent workspace .env without any warning about persistence, file permissions, downstream access, or cleanup. Even if intended for convenience, storing secrets this way can expose them to other tools, users, backups, or later agent actions in the same workspace.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The failure-handling section states to 'Return task to actionable state (todo or in-progress)', which implies recovery back into dispatchable workflow. But the same section's scenario table says timeouts, blocked results, and missing deliverables should 'Set failed', and earlier sections also describe failed as the terminal outcome for unsuccessful execution, so the documentation contradicts itself about actual intended state transitions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains multiple natural-language comments and the cron payload message in Chinese (for example at L063, L069-L075, and L090) while the rest of the document is in English. For a general configuration reference, forcing a specific language without opt-in or documented locale scope can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs users in Chinese and the template fields require Chinese outputs such as '<一句话目标>' and Chinese status text, which imposes a specific language on skill usage. There is no opt-in or documented locale-specific justification, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The 'Output Format (Required)' section requires fields like 'summary: <一句话总结>' and 'blocked 写阻塞点与建议', which constrains replies to Chinese-language content. Because no alternative locale or user choice is provided, this violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default --message value is written entirely in Chinese and will be used unless the user overrides it. This imposes a specific language choice by default without offering any locale selection or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The setup instructions tell users to export an API access token but do not warn that the token is sensitive credential material that grants access to the task board API. In practice, README examples are often copied into shells, logs, screenshots, and shared environments, so lack of credential-handling guidance can lead to accidental exposure or misuse.

Content

No source excerpt is available for this finding.