Openclaw Command Center

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:04 AM UTC
• Version: 1.4.1

Overview

This appears to be a real OpenClaw monitoring dashboard, but it also includes administrative controls, transcript-derived identity tracking, persistent local changes, and optional external sync that are broader than a simple viewer.

Install only if you intend to run an administrative OpenClaw control dashboard, not just a passive monitor. Keep it bound to localhost or a private network, enable real authentication, review any Cloudflare/Tailscale exposure, avoid copying an auth 'none' example into shared environments, and inspect/disable Linear sync, job-control actions, transcript-derived identity tracking, and system dependency installation unless you explicitly need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions even though the metadata and documented startup behavior indicate shell execution, environment access, and network exposure via a local HTTP server. This is dangerous because users and tooling cannot accurately assess the skill's effective capabilities, increasing the chance of unintended execution in environments that would have denied or sandboxed those actions if properly declared.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is a read-oriented monitoring dashboard, but the described behavior includes state-changing actions such as modifying topic status, managing operators and privacy settings, controlling jobs, syncing to an external Linear API, and operating a Cloudflare tunnel. This mismatch is dangerous because users may grant trust expecting passive observability while the skill actually has administrative and external communication capabilities that can alter local state, trigger jobs, or expose data beyond the host.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The jobs API exposes multiple state-changing administrative actions including run, pause, resume, skip, kill, and cache clear. For a skill presented as a monitoring dashboard, this materially expands authority and turns the service into a control plane; if authentication is weak or disabled, an attacker can disrupt scheduled jobs or force execution.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The cerebro topic status endpoint writes directly to topic.md files on disk, allowing remote mutation of local state from a dashboard service. This exceeds a view-only role and creates integrity risk if an unauthorized caller can alter topic tracking data or if operators assume the service is read-only.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill persists privacy settings and operator metadata to disk, making it more than a passive viewer. While not inherently malicious, hidden local writes increase the blast radius of compromise and violate expectations for a monitoring-only dashboard.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code scans session transcripts to extract Slack, Telegram, and Discord identities, then stores derived operator records locally. This creates a privacy-sensitive identity map from conversation data that is broader than necessary for a dashboard and could expose human participants if the dashboard or storage is accessed by others.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The public description frames the service as a dashboard, while the code includes mutating administrative behaviors elsewhere. This mismatch is dangerous because users and deployers may grant access assuming read-only behavior, leading to underestimation of risk and weaker controls.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The dashboard exposes state-changing actions such as health checks, gateway status queries, and stale-session pruning from the client UI, which goes beyond passive monitoring. In an admin dashboard this increases attack surface because any user who can access the page and corresponding endpoints may be able to trigger operational changes or maintenance actions.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The page is described as a monitoring/dashboard interface, but it includes active control operations that invoke POST requests to run, pause, and resume jobs. This expands the skill’s effective privilege from read-only observability to state-changing job orchestration, increasing the risk of unauthorized or accidental task execution if the UI is exposed or trusted as passive-only.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This script performs real host package installation by parsing a project-controlled JSON file and executing package-manager commands on the user's machine. For a skill described as a monitoring/dashboard component, modifying the host OS is broader than expected and creates a supply-chain risk: if the dependency file is altered or overly permissive, the script will run privileged installation commands without strong validation or confinement.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The Node helper discovers the system package manager and directly executes install commands from `config/system-deps.json` via `execSync(cmd, { stdio: 'inherit' })`. In the context of a dashboard/monitoring skill, this host-level command execution is not justified by the stated purpose and is dangerous because it expands the trust boundary from reading telemetry to making persistent system changes, potentially with elevated privileges.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script goes beyond passive dashboard monitoring and actively mutates third-party project-management state in Linear based on local session activity. That creates an integrity-impacting side effect channel where ordinary agent/session content can trigger external workflow changes without strong authorization, validation, or explicit user intent at the point of action.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code reads session transcripts, extracts issue identifiers from message content, and uses them to drive updates to external Linear issues. This lets untrusted transcript content influence external actions, creating a data-governance and workflow-tampering risk even if the full transcript is not directly uploaded.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The code stores per-session identifiers alongside inferred topics, creating a durable linkage between session activity and derived behavioral metadata. In a monitoring/dashboard context, retaining session-linked topic history increases privacy risk and can expose user activity patterns if the state file is accessed by other components or users on the system.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The authentication logic unconditionally authorizes any request whose remote address appears to be localhost before evaluating the configured auth mode. For a monitoring dashboard that exposes session, usage, cost, and system data, this creates a trust bypass: any path that allows requests to originate from or appear as loopback (such as local SSRF, reverse proxy misconfiguration, container/network namespace quirks, or local untrusted users/processes) gains full access without credentials.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The dashboard includes non-read-only endpoints such as /api/cerebro/topic/.../status and /api/action that modify application state or trigger actions, which expands the attack surface beyond passive monitoring. In a monitoring dashboard, control-plane operations are more dangerous because any auth bypass, weak auth configuration, or cross-origin abuse could let an attacker change status or invoke backend behavior rather than just read telemetry.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The /api/operators and /api/privacy routes accept writes and persist configuration data, meaning the dashboard is not purely observational and can alter stored operator metadata and privacy settings. If authentication is misconfigured, disabled, or bypassed, an attacker could tamper with operational records or privacy controls, potentially hiding activity or corrupting administrative data.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The dashboard module goes beyond operational telemetry and reads full subagent transcripts, then extracts task content for display. That creates unnecessary exposure of potentially sensitive conversation data, increasing the risk of privacy leakage, overcollection, and accidental disclosure to dashboard viewers who only need monitoring metadata.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code inspects user-message contents inside transcripts to infer labels and task summaries using regexes and fallback heuristics. This content mining is not clearly necessary for a mission-control dashboard and can surface sensitive prompts, issue names, internal identifiers, or confidential task descriptions to interfaces or operators not authorized to read raw conversation content.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The utility exposes a generic shell execution helper that accepts an arbitrary command string and passes it to child_process.exec, which invokes a shell. If any caller ever feeds this function untrusted or partially controllable input, it can lead to command injection and arbitrary code execution. In a dashboard/monitoring skill, some system-command usage may be expected, but a reusable unrestricted executor significantly increases the attack surface and is broader than necessary for the stated purpose.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README advertises monitoring sessions, operators, memory files, topic data, and cost details, but it does not prominently warn that the dashboard may expose sensitive operational, personal, or secret-adjacent information from agent activity. In a monitoring skill, that omission can lead operators to deploy or share the dashboard too broadly, increasing the risk of unintended disclosure even if the software is read-only.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README explicitly advertises visibility into sessions, operators, memory files, and system state, but it does not pair those capabilities with a prominent warning that enabling or sharing the dashboard can expose sensitive operational and personal data. In the context of a monitoring dashboard for AI agents, this omission can lead users to deploy or demo the service without understanding the privacy exposure, especially if authentication is weakened or disabled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation advertises a dashboard at localhost:3333 but does not clearly warn that it aggregates sensitive session, usage, and system telemetry and serves it over HTTP. This is dangerous because users may start the service without understanding the exposure risk, especially if they later enable remote access modes such as token, tailscale, or cloudflare, potentially broadening access to operational and privacy-sensitive data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example configuration sets authentication mode to "none", which can lead operators to deploy the dashboard without access control if they copy the sample as-is. In the context of a mission-control dashboard that exposes session monitoring, analytics, and system status, unauthenticated access could reveal sensitive operational data and potentially expand the attack surface if additional endpoints are present.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Session and operator endpoints return conversation-derived and identity-linked data without any in-file indication of user-facing disclosure or consent. In a dashboard context this can leak sensitive transcript content, inferred topics, and operator associations to anyone with access to the UI or API.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib/server.js:461

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/install-system-deps.sh:50

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/linear-sync.js:495

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/llm-usage.js:19

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/openclaw.js:46

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/iostat-leak.test.js:16

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/server.test.js:14