ClawHub
Back to skill

Security audit

Dashboard Generator

Security checks for vulnerabilities and agentic risk

Overview

This dashboard skill is coherent, but it sets up persistent jobs and serves comprehensive memory, ledger, and usage data without clear access controls or removal controls.

Install only if you intend to run a persistent local dashboard for private operational data. Before enabling it, verify that the server binds only to localhost, add authentication or another access gate, review the external scripts it runs, restrict permissions on the served directories, and document how to stop and remove the cron jobs and watchdog.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:16
Finding

Recurring Cron Jobs Establish Unattended Cross-Session Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-36
Vulnerability Type: Scheduled-task persistence
Risk Level: High

Vulnerable code segment:

markdown
## Regeneration (hourly, `:00 + 5min stagger`)

Run in order:

```bash
/usr/bin/python3 /home/hobopi/.openclaw/workspace/scripts/gen-memory-dashboard.py
/usr/bin/python3 /home/hobopi/.openclaw/workspace/scripts/gen-expense-data.py
/usr/bin/python3 /home/hobopi/.openclaw/workspace/scripts/track-usage.py --dashboard
  • Timeout: 180s for all three
  • Cron: isolated agentTurn, delivery mode none (no Telegram notification)

Dashboard server (8081)

  • Script: scripts/serve-dashboards.py
  • Serves files from /home/hobopi/.openclaw/workspace/dashboard/ and /home/hobopi/.openclaw/workspace/memory/
  • Watchdog cron (every 300ms): checks HTTP 200 on port 8081 every 5 minutes
  • If down: kills old process, restarts script, rechecks
  • Watchdog uses default model (not time-sensitive, no user delivery)
text

### Technical Analysis

The skill directs the agent to use recurring cron tasks for hourly dashboard generation and a watchdog that kills and restarts a service. These tasks continue running after the initiating skill invocation has ended, creating system persistence.

The scheduled commands target absolute paths outside the reviewed package. None of the referenced Python scripts are present in the supplied artifact, so their contents, ownership, permissions, and integrity cannot be verified. If another user or process can alter any referenced script, the cron mechanism will execute the modified content automatically at every scheduled interval. The watchdog additionally restores the dashboard process after termination, making the process resistant to ordinary shutdown attempts.

The claim that delivery mode is `none` also reduces visibility because scheduled executions do not produce the stated Telegram notification. The documentat
...[truncated 1203 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not create recurring jobs automatically when the skill is loaded or invoked.
  • Require explicit, informed user approval before creating each scheduled task, including disclosure of its command, frequency, execution identity, and lifetime.
  • Prefer bounded foreground execution for dashboard generation when persistence is unnecessary.
  • Store executable scripts inside the reviewed package and verify their integrity before execution.
  • Ensure scheduled scripts and their parent directories are writable only by the owning account or an administrator.
  • Use a dedicated least-privileged service account with access only to the required input and output directories.
  • Replace the ambiguous watchdog interval with one clear, rate-limited schedule.
  • Provide exact commands for listing, disabling, and permanently removing all created cron entries.
  • Log each scheduled invocation and restart to a protected audit log rather than using a fully silent delivery configuration.
  • Add failure limits and backoff so a broken or compromised service is not restarted indefinitely.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:8
Finding

Sensitive Memory and Financial Records May Be Exposed Through an Unauthenticated HTTP Dashboard

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-13 and 30-34
Vulnerability Type: Potential unauthenticated exposure of sensitive data
Risk Level: Medium

Vulnerable code segments:

markdown
## Dashboard types

| Dashboard | File | Content |
|-----------|------|---------|
| Memory | `memory/dashboard.html` | All daily logs embedded as cards, searchable |
| Expense | `dashboard/usage/expense-data.json` | All ledger entries as JSON (fed to chart) |
| Usage | `dashboard/usage/dashboard.json` | Token counts, costs, calls per source |
markdown
## Dashboard server (8081)

- Script: `scripts/serve-dashboards.py`
- Serves files from `/home/hobopi/.openclaw/workspace/dashboard/` and `/home/hobopi/.openclaw/workspace/memory/`
- Watchdog cron (`every 300ms`): checks HTTP 200 on port 8081 every 5 minutes
- If down: kills old process, restarts script, rechecks

Technical Analysis

The documented design embeds all daily memory-log content into an HTML file and writes all ledger entries to JSON. It then serves the containing dashboard and memory directories over HTTP on port 8081.

The skill does not require authentication, authorization, transport encryption, data redaction, an explicit file allowlist, or a loopback-only bind address. Consequently, an implementation that binds to 0.0.0.0, a LAN interface, or another externally reachable interface could expose complete logs, financial ledger entries, and usage metadata to unauthenticated clients.

The referenced scripts/serve-dashboards.py implementation is not included in the artifact. Therefore, actual external reachability cannot be confirmed from the reviewed files. The confirmed weakness is that the security-sensitive serving requirements are omitted while the skill explicitly instructs the service to publish directories containing comprehensive records.

Attack Path

  1. The generation scripts collect daily logs, ledger ...[truncated 1039 chars]
Remediation
View remediation

Remediation Suggestions

  • Require the HTTP server to bind explicitly to 127.0.0.1 or a Unix-domain socket by default.
  • Refuse startup on a non-loopback interface unless the user explicitly enables remote access and configures authentication.
  • Add strong authentication and authorization before serving any dashboard containing memory or financial data.
  • Use TLS through a securely configured reverse proxy whenever traffic can leave the local host.
  • Serve an explicit allowlist of generated files rather than entire directories.
  • Redact secrets, personal information, account identifiers, and unnecessary ledger details before dashboard generation.
  • Avoid embedding complete daily logs in client-side JavaScript; generate limited views containing only fields required by the dashboard.
  • Apply restrictive filesystem permissions to generated HTML and JSON files.
  • Add security headers, including a restrictive Content Security Policy, X-Content-Type-Options: nosniff, and controls against framing.
  • Document the server's bind address, authentication model, firewall requirements, and expected audience.
  • Include scripts/serve-dashboards.py in the package so its routing, path normalization, authentication, and network binding can be audited.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly generates and serves dashboards containing all daily memory logs, ledger expense data, and token usage data, including embedded log content and structured usage history, but provides no access-control, redaction, or privacy warning. Because the dashboards are served over an HTTP port and regenerated automatically, this creates a realistic risk of unintended disclosure of sensitive operational data, prompts, secrets, financial information, or personal data contained in logs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.