ClawHub
Back to skill

Security audit

Mission Control

Security checks across malware telemetry and agentic risk

Overview

Mission Control is a disclosed OpenClaw dashboard, but it asks users to run an unpinned external web app with broad agent-control access and local gateway-token use.

Install only if you trust and review the linked GitHub project and its npm dependencies. Pin the repository to a known commit, keep the dashboard bound to localhost, avoid exposing it on a network without strong authentication, inspect the systemd service before enabling it, and treat the OpenClaw gateway token as a sensitive credential.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly states it auto-detects and reads a gateway token from the user's local OpenClaw configuration, but the documentation provides no warning, consent flow, or explanation of how that credential is stored, transmitted, or protected. In a web dashboard that exposes monitoring and control functions, silent credential discovery increases the risk of accidental overexposure of a sensitive token and unauthorized agent control if the dashboard or host is compromised.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.