ClawHub
Back to skill

Security audit

Mission Control

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a plausible OpenClaw dashboard, but its setup runs unpinned remote code, uses OpenClaw gateway credentials, and offers root-level persistent service installation without enough scoping.

Review the external repository and service file before installing, prefer a pinned release or commit, use npm ci with lockfiles where available, avoid enabling the system service until you confirm it runs as an unprivileged local-only service, and use a dedicated least-privilege OpenClaw token rather than a primary gateway credential.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unpinned Remote Code and Dependencies Are Retrieved and Executed

Content
View full analysis
/dev/null || cd ~/clawd git clone https://github.com/Jzineldin/mission-control.git cd mission-control # Install dependencies + build frontend npm install cd frontend && npm install && npm run build && cd .. # Create your config cp mc-config.default.json mc-config.json # Start (dev) node server.js ``` ### Technical Analysis The installation procedure clones the current default branch of an external Git repository without pinning a reviewed commit, release, or signed tag. It subsequently runs `npm install` for two dependency trees, executes a frontend build, and starts the downloaded server. The effective payload can therefore change after the Skill itself has been reviewed. In addition, npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`, which can run arbitrary commands with the installing user's privileges. The instructions do not require checksum or signature verification, lockfile-enforced installation through `npm ci`, dependency auditing, or inspection of lifecycle scripts. The remotely downloaded source code and dependency manifests were not included in the audited artifact, so their behavior could not be verified. ### Attack Path 1. An attacker compromises the remote repository, a maintainer account, or an npm dependency. 2. The attacker adds malicious application code or an npm lifecycle script. 3. A user follows the Skill instructions and clones the mutable default branch. 4. `npm install`, `npm run build`, or `node server.js` executes the modified payload. 5. The payload runs with the user's permissions and can access files available to that account, including OpenClaw configuration data. 6. If the user subsequently ena ...[truncated 594 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:28
Finding

Unaudited Remote Application Is Registered as a Persistent System Service

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:59
Finding

Dashboard Automatically Accesses the OpenClaw Gateway Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
76% confidence
Finding

The documentation instructs users to run sudo cp mission-control.service /etc/systemd/system/, which requires root privileges and installs files into a privileged system location. While common for service setup, asking users to elevate privileges for a repository-cloned artifact expands the blast radius if the service file or surrounding project contents are malicious or modified.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

node server.js

Or use systemd for production:

sudo cp mission-control.service /etc/systemd/system/

Edit paths in the service file, then:

sudo systemctl enable --now mission-control

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
79% confidence
Finding

The command sudo systemctl enable --now mission-control starts the service immediately and configures it to run with persistence under system control, requiring elevated privileges. In the context of a dashboard that controls an agent and auto-detects local credentials, enabling it as root-backed infrastructure makes accidental overexposure or misuse more consequential.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Or use systemd for production:

sudo cp mission-control.service /etc/systemd/system/

Edit paths in the service file, then:

sudo systemctl enable --now mission-control

text

Visit `http://localhost:3333` — the Setup Wizard auto-detects your OpenClaw config.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

systemctl enable --now establishes persistence so the dashboard will restart automatically, which is a recognized persistence mechanism. Persistence is not inherently malicious, but in this context it is security-relevant because the service offers monitoring/control features and may auto-consume a gateway token, so compromise or misconfiguration would survive reboots and continue exposing access.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Or use systemd for production:

sudo cp mission-control.service /etc/systemd/system/

Edit paths in the service file, then:

sudo systemctl enable --now mission-control

text

Visit `http://localhost:3333` — the Setup Wizard auto-detects your OpenClaw config.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that the Setup Wizard auto-detects local OpenClaw configuration and the configuration section says it reads the gateway token from ~/.openclaw/openclaw.json, but the install/usage text does not warn users that a sensitive local credential will be discovered and used by the dashboard. Because this is a web dashboard that can monitor and control the agent, silent ingestion of the gateway token materially increases the risk of unauthorized local control, credential exposure, or accidental over-trust by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.