Security audit

Agent Kanban

Security checks across malware telemetry and agentic risk

Overview

This is a real OpenClaw dashboard, but its defaults can expose agent sessions, local agent files, and gateway access more broadly than users are told.

Install only after changing the defaults: remove and rotate the committed token, keep credentials in an untracked local secret or environment variable, bind the server to 127.0.0.1, restrict CORS, and add authentication before exposing session history or agent files. Avoid running it on shared or untrusted networks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes behavior that requires access to local configuration data and networked gateway APIs, but it does not declare those capabilities or permissions. This creates a transparency and consent problem: operators may install a seemingly simple dashboard without understanding that it reads local state and communicates with privileged services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The advertised purpose is monitoring, but the documented behavior extends into reading full agent files, accessing local OpenClaw directories, and handling gateway authentication material. That mismatch is dangerous because users may grant trust appropriate for a dashboard while the skill exposes sensitive workspace contents and control-plane credentials.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file contains a hardcoded Gateway API token directly in source code, which is credential material that grants access to the local OpenClaw gateway. Embedding secrets in a distributed skill is dangerous because anyone who can view the repository, package, logs, or deployed files can reuse the token to query or control the gateway, and the dashboard context increases risk because it is meant to monitor all agents and session data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The dashboard sends agent-specific identifiers to a third-party avatar service by embedding `agent.key` in the Dicebear URL. In this skill's context, agent/session identifiers and monitoring metadata may be sensitive, so loading remote avatars leaks operational data to an unrelated external service and creates a dependency on third-party availability and integrity.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: React and ReactDOM are loaded at runtime from external CDN endpoints, giving those remote sources control over code executed in this privileged dashboard. Because this UI displays agent status, session history, and file contents, a compromised CDN, MITM, or dependency swap could exfiltrate sensitive backend data directly from users' browsers.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The `/api/agents/:agentId/files` endpoint returns full contents of sensitive workspace files such as `SOUL.md`, `HEARTBEAT.md`, and `OKR.md`, which likely contain internal prompts, objectives, operational instructions, or other private agent state. In a monitoring dashboard context, exposing raw file contents goes beyond status visibility and creates a direct data disclosure surface to any caller, especially because the server also enables permissive cross-origin access and shows no authentication checks in this file.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code reads agent workspace documents directly from disk based on a request parameter without a clear need tied to the stated monitoring purpose. Even though the filenames are fixed, this still exposes sensitive operational documents from agent workspaces and broadens the dashboard from observability into document exfiltration.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation explicitly teaches users how to extract the gateway token from a local config file, but does not warn that the token is a sensitive credential or advise secure handling. This increases the chance of accidental disclosure through shell history, screenshots, logs, pasted output, or reuse in insecure contexts.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The token value is explicitly exposed at line 35 with no masking, warning, or runtime prompt, making the credential trivially collectible by any reader of the file. Even though the gateway URL is localhost, local services are commonly reachable by other local users, malware, containers, browser-based attacks via a companion service, or through port forwarding, so disclosure of a valid token can enable unauthorized access to sensitive agent status and session information.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The server uses a user-controlled `agentId` to select which workspace directory to read from and does not validate the identifier against an allowlist or canonical agent registry. While the code only reads fixed filenames, an attacker may still access documents for arbitrary agents, and malformed identifiers could lead to path traversal depending on deployment paths and filesystem layout.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README explicitly instructs users to extract a gateway bearer token from a local config file and reuse it, but gives no warning about treating the token as a secret or avoiding exposure in copied commands, screenshots, shell history, or committed config files. Because this dashboard is designed to access agent status, session history, and file contents, leakage of the token could grant unauthorized access to sensitive operational and conversation data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The authenticated curl example demonstrates direct bearer-token use against the gateway API without any warning about credential protection or the sensitivity of the returned session data. In the context of this skill, the API can enumerate sessions and likely expose agent activity and history, so normalizing copy-paste token usage increases the chance of accidental disclosure or misuse.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: assets/agent-kanban/server.js:28