T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:138- Finding
Mandatory VIP Promotional Content Hijacks Generated Output
- Content
View full analysis
`, JS dans `- Remediation
View remediation
Security audit
wesley dashboard builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real dashboard builder, but its deployment guidance can expose live services publicly and persist processes with root-level infrastructure access.
Review this skill before installing or using it. Treat the deployment commands as administrator actions: replace the hardcoded VPS details, avoid root SSH, do not expose the API publicly without authentication, restrict CORS to approved origins, pin dependencies, and only enable Telegram uploads or VIP payment links after explicit user approval.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T06 · System Persistence
Error
- Location
DEPLOYMENT.md:125- Finding
Container Startup Modification Creates Cross-Session Persistence
- Content
View full analysis
/start-dashboard.sh << '"'"'EOF'"'"' #!/bin/bash sleep 10 # attendre que le container soit prêt cd /data/.openclaw/workspace/projects/wesley-dashboard python3 -m http.server 8765 & cd /data/.openclaw/workspace python3 api/dashboard_api.py --port 8766 & echo "Dashboard started" >> /data/.openclaw/workspace/logs/startup.log EOF chmod +x /start-dashboard.sh' ``` ```yaml command: sh -c "/start-dashboard.sh & /original-start-command" ``` ### Technical Analysis The deployment procedure creates an executable script inside the container and changes the container command so that the dashboard and API are launched automatically whenever the container starts. This behavior survives the original Skill invocation and future container restarts. The persisted command executes mutable Python content from the workspace. If `api/dashboard_api.py` or the dashboard directory is later replaced or modified, the altered content will be launched automatically. Running the startup script in the background also provides weak lifecycle and failure management: the container runtime does not directly supervise the two services, and their failure may not affect container health. ### Attack Path 1. An administrator follows the deployment instructions. 2. `/start-dashboard.sh` is written into the container and marked executable. 3. The Compose command is changed to invoke the script at startup. 4. An attacker or compromised deployment process modifies `api/dashboard_api.py` or another startup target. 5. The container is restarted manually, by the orchestrator, or after a host reboot. 6. The modified Python payload executes automatically without another expl ...[truncated 475 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
DEPLOYMENT.md:30- Finding
Root-Level Deployment and Public Port Mapping Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
DEPLOYMENT.md:197- Finding
Wildcard CORS Permits Unrestricted Cross-Origin API Reads
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:71- Finding
Unpinned CDN and Python Dependencies Create Supply-Chain Risk
- Content
View full analysis
``` ```javascript // CDN à ajouter : ``` ```html ``` ```bash docker exec openclaw-yyvg-openclaw-1 pip3 install flask-cors --break-system-packages ``` ### Technical Analysis The Chart.js URL does not specify an exact version and has no Subresource Integrity hash. Consequently, builds or page loads performed at different times may receive different library versions. Browser code loaded from a CDN executes with the same page privileges as first-party JavaScript and can read or modify dashboard content. The `flask-cors` installation similarly lacks an exact version and package hash. The `--break-system-packages` option bypasses the environment protection intended to prevent uncontrolled changes to system-managed Python installations. Although the html2canvas URL identifies version 1.4.1, it is also included without an integrity hash. No evidence shows that the named packages are currently malicious. The vulnerability is the mutable, insufficiently verified supply-chain configuration. ### Attack Path 1. A dashboard is generated or deployed using the documented dependency URLs. 2. The package resolver or CDN supplies the currently available unpinned release. 3. A compromised upstream account, CDN response, dependency release, or incompatible update introduces unwanted code. 4. For CDN dependencies, the code executes in every visitor's browser with access to the dashboard DOM and API responses. 5. For th ...[truncated 542 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
'cd /data/.openclaw/workspace && python3 api/dashboard_api.py 2>/workspace/logs/api.log &'
Vérifier
curl http://72.62.30.28:8766/health
Réponse attendue : {"status": "ok", "uptime": ...}
text
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The deployment guide goes beyond generating dashboard files and instructs users to modify container startup behavior, expose services, and manage infrastructure components. In a web-dashboard skill context, these broad administration steps increase attack surface and enable persistent externally reachable services without any hardening guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions explicitly open ports and publish direct infrastructure endpoints, including a public IP and service ports, without warning about exposure risks. That can lead users to unintentionally expose internal dashboards and APIs to the internet, increasing the chance of reconnaissance, abuse, and data leakage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Cloudflare tunnel setup makes both dashboard and API publicly reachable, including guidance for a permanent named tunnel, but provides no warning about public accessibility, authentication, or data sensitivity. In this skill's context of live dashboards and performance pages, that creates a direct path to exposing portfolio or signal data to the public internet.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 1. Créer le tunnel (une seule fois) cloudflared tunnel create wesley-dashboard # 2. Configurer ~/.cloudflared/config.yml tunnel: <ID-DU-TUNNEL>
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documented CORS fix enables
CORS(app, origins=['*']), which allows any website to make browser requests to the dashboard API. If the API serves sensitive trading or account data, this broad cross-origin access can expose data to untrusted origins and make later authenticated endpoints unsafe by default.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide encourages broad sharing of the public dashboard URL across social platforms without discussing that the linked service may expose live data and infrastructure-backed functionality. This normalizes public distribution of an internet-facing service that may not be hardened or intended for unrestricted access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file's instructional natural language consistently forces a specific language/locale, with no indication that users may opt into another language or that the skill is intentionally limited to a French-speaking audience. Under the stated policy, fixed language behavior without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description is explicitly framed as a French-language skill ("Skill de création...") and all operational instructions are written in French, but there is no indication that language is user-selectable or that the locale restriction is required for a region-specific use case. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation criteria are extremely broad and instruct the agent to 'always use this skill' for many common web-related requests involving Wesley. Over-broad routing can cause the skill to activate in contexts where its extra permissions, network behavior, or deployment guidance are unnecessary, increasing exposure to unintended external calls and privileged actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill requests TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID despite its primary stated function being dashboard and static web page generation. Introducing bot credentials expands the trust boundary and enables external data transmission or message/media access unrelated to the minimum functionality, increasing the chance of credential misuse or unintended exfiltration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes Telegram photo uploads and use of bot credentials, but does not clearly warn the user that images and related metadata may be transmitted to an external third-party service. This undermines informed consent and can lead to privacy leakage, especially if personal or sensitive media is uploaded automatically.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The deployment section includes direct SCP to a public IP, Docker exec on a remote container, and a Cloudflare tunnel URL, which goes beyond code generation into infrastructure access and remote command execution. If followed automatically or by an over-permissioned agent, this could modify production systems, expose services publicly, or leak operational details.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All operational guidance in the file is written in French, and there is no indication that this locale is optional or required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes a UI control and JavaScript that captures the full page and automatically downloads a PNG to the user's device. While the code is user-initiated via a button, the surrounding documentation does not explicitly warn that clicking it will create and save a local file containing the rendered page content.
- Content