Security audit

OpenClaw Dashboard

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local OpenClaw dashboard that reads sensitive operational data and has opt-in meeting audio features, but its sensitive behavior is purpose-aligned, authenticated, and mostly gated.

Install this only for trusted OpenClaw operators. Keep it bound to loopback or behind strong access control, set a strong OPENCLAW_AUTH_TOKEN, and enable config inspection or Copilot only when you are comfortable exposing workspace documents, memory logs, meeting transcripts/audio, and channel metadata to dashboard users and the configured realtime provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill declares access to environment variables, local files, networked services, and installation via CLI, but there is no explicit permissions section describing or constraining those capabilities. This creates a trust and review gap: operators may install a skill that can access sensitive tokens and local state without a clear machine-readable declaration of what it needs.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The status endpoint reports `channelIsolation: true`, but the runtime can still subscribe to and publish on shared legacy channels such as `meeting.transcript`, `meeting.rag_hits`, and `meeting.insights` when `legacyCompat` is enabled. This can mislead operators and auditors into believing tenant/session isolation is stronger than it actually is, increasing the chance of cross-meeting data exposure or unsafe deployment decisions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The provider enriches ledger analytics with Ground Truth channel names, linking usage/cost records to identifiable meeting or channel metadata that is not necessary for core billing aggregation. If these endpoints are accessible to broader dashboard users, this creates an unnecessary privacy boundary crossing and may expose opt-in meeting/copilot context or internal channel identities to viewers who only need aggregate cost data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The config endpoint returns the full contents of selected workspace markdown files and configuration data to any caller when ENABLE_CONFIG_ENDPOINT is set, with no authentication, authorization, or user-consent mechanism shown in this provider. Although some JSON secrets are redacted, the endpoint still exposes potentially sensitive operational data, prompts, identities, memory, references, and metadata that may contain confidential information or enable further attacks.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The `/dashboard/spark/today` response includes `filePath: NFS_SPARK_TODAY`, which discloses an internal absolute filesystem path to any caller of the endpoint. While this does not directly grant file access, it leaks environment and directory layout details that can aid reconnaissance, especially in a dashboard/backend operations context where paths may reveal usernames, mount points, and storage design.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The /logs endpoint reads every .md file from cfg.MEMORY_DIR and returns full file contents to any caller of the route. Memory logs often contain operational notes, internal prompts, tokens, stack traces, or other sensitive data, so exposing them wholesale creates a direct information disclosure risk if the dashboard is reachable by unauthorized users or lower-privileged users.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/test-dashboard.js:219

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/test-dashboard.js:222