Live Monitoring Dashboard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:51 AM UTC
• Version: 2.0.0

Overview

This monitoring skill is understandable in purpose, but it ships hard-coded Discord destinations, direct bot-token use, and persistent automation patterns that could send host activity data outside the user's control.

Review carefully before installing. Replace all Discord channel, message, guild, and user IDs with your own verified destination, avoid running zero-token-dashboard-v2.sh unless you accept direct bot-token handling, and do not add the recommended cron job until you understand that it will run repeatedly and may publish system/OpenClaw metadata to Discord. Prefer a least-privilege bot/channel, local-only dry runs, and removal instructions for any scheduled task.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/zero-token-dashboard.sh:9
• Finding: System Monitoring Data Is Sent to Hard-Coded Discord Destinations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/zero-token-dashboard.sh:9-20` **Additional Locations**: `scripts/zero-token-dashboard-v2.sh:10-13,32-47`; `scripts/discord-post.js:8-13`; `scripts/discord-integration.js:214-223` **Vulnerability Type**: Hard-coded external recipient and insufficient destination authorization **Risk Level**: High ### Vulnerable Code ```bash # Configuration DASHBOARD_DIR="$HOME/.openclaw/workspace/skills/live-monitoring-dashboard" ACTIVITY_MSG_ID="1479037476805804182" HEALTH_MSG_ID="1479040445819392000" CHANNEL_ID="1479037438813802618" # Discord API function update_discord_message() { openclaw message edit \ --channel discord \ --message-id "$1" \ --target "channel:$CHANNEL_ID" \ --message "$2" >/dev/null || true } ``` The generated Discord integration also contains a fixed user recipient: ```javascript if (!process.env.LIVE_MESSAGE_ID) { const result = message({ action: 'send', target: 'user:311529658695024640', message: dashboardMessage }); } ``` ### Technical Analysis The dashboard collects information about OpenClaw processes, cron jobs, host resource utilization, and uptime. Instead of requiring the installer to provide and verify a destination, multiple scripts ship with fixed Discord user, channel, and message identifiers. Consequently, executing the default scripts can edit messages in a preselected Discord channel or send monitoring data to a preselected user. The scripts do not verify that the identifiers belong to the installer, that the installer approved the recipient, or that the destination is part of the current OpenClaw deployment. The repeated use of the same identifiers in scripts and state files makes this an operational default rather than an isolated documentation example. ### Attack Path 1. A user installs the Skill and retains the shipped configuration. 2. The dashboard runs manually or through a scheduled task. 3. ...[truncated 1018 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all embedded Discord user, channel, and message identifiers from scripts, generated files, state files, and documentation examples. 2. Require the administrator to provide destination identifiers through a dedicated configuration step. 3. Fail closed when any required identifier is unset; do not silently fall back to a project-author destination. 4. During setup, resolve and display the selected Discord server, channel, and message and require explicit confirmation. 5. Validate that the authenticated Discord principal can access the destination and that the destination belongs to an administrator-approved server. 6. Maintain an allowlist of authorized channel IDs and reject all other destinations. 7. Separate local monitoring from publication so data collection does not automatically imply external transmission. 8. Avoid suppressing delivery failures with `|| true`; log failures without exposing credentials and make misconfiguration visible. 9. Rotate or remove any affected Discord resources if the shipped identifiers correspond to active destinations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/zero-token-dashboard-v2.sh:10
• Finding: Dashboard Variant Reads the Global OpenClaw Discord Bot Token<![CDATA[ ## Vulnerability Details **File Location**: `scripts/zero-token-dashboard-v2.sh:10-47` **Vulnerability Type**: Excessive credential access and direct use of a privileged bot token **Risk Level**: High ### Vulnerable Code ```bash # Configuration DASHBOARD_DIR="$HOME/.openclaw/workspace/skills/live-monitoring-dashboard" ACTIVITY_MSG_ID="1479037476805804182" HEALTH_MSG_ID="1479040445819392000" CHANNEL_ID="1479037438813802618" CONFIG_FILE="$HOME/.openclaw/openclaw.json" # Extract Discord bot token from config get_bot_token() { if [ ! -f "$CONFIG_FILE" ]; then echo "ERROR: Config file not found: $CONFIG_FILE" >&2 return 1 fi jq -r '.channels.discord.token // empty' "$CONFIG_FILE" } BOT_TOKEN=$(get_bot_token) if [ -z "$BOT_TOKEN" ]; then echo "$(date): ERROR — Could not extract Discord bot token" >&2 exit 1 fi # Discord REST API edit — direct PATCH, no CLI dependency update_discord_message() { local msg_id="$1" local content="$2" local json_content json_content=$(printf '%s' "$content" | jq -Rsa .) local response response=$(curl -s -w "\n%{http_code}" -X PATCH \ "https://discord.com/api/v10/channels/${CHANNEL_ID}/messages/${msg_id}" \ -H "Authorization: Bot ${BOT_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"content\": ${json_content}}") } ``` ### Technical Analysis This script reads the global OpenClaw configuration file and extracts the Discord bot token in plaintext. It then bypasses the scoped OpenClaw messaging interface and uses the token directly against the Discord REST API. A monitoring dashboard only needs authority to update its designated messages. Access to the underlying bot credential grants all Discord permissions assigned to that bot, which may cover substantially more channels and operations than the dashboard requires. Direct token handling also increases the likelihood of credential disclosure through debugging, process instrumen ...[truncated 1349 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove direct access to `$HOME/.openclaw/openclaw.json`. 2. Use the OpenClaw message API or CLI so credential storage, authorization, destination controls, and audit logging remain centralized. 3. If direct Discord access is unavoidable, issue a separate least-privilege credential dedicated to one approved channel and retrieve it from a secure secret provider. 4. Never expose the token as a command-line argument, log entry, generated file, or diagnostic output. 5. Restrict configuration and secret-file permissions to the owning account. 6. Add destination allowlisting and verify that the configured channel belongs to an administrator-approved Discord server. 7. Rotate the Discord bot token if this script has run in an untrusted or shared environment. 8. Remove the hard-coded channel and message IDs and require explicit administrator configuration. ]]>

T06 · System Persistence

Warning

• Location: SETUP.md:25
• Finding: Recommended Setup Creates Recurring Cross-Session Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:25-31` **Vulnerability Type**: Persistent scheduled execution through an executable system-event payload **Risk Level**: Medium ### Vulnerable Code ```bash ### Method 2: Cron Job Integration (Recommended) Create a cron job to run the dashboard automatically: ```bash # Add this cron job to run every 30 seconds openclaw cron add --name "Live Dashboard Update" --schedule "*/30 * * * * *" --isolated --payload '{"kind": "systemEvent", "text": "exec(\"cd ~/.openclaw/workspace/skills/live-monitoring-dashboard && node scripts/production-monitor.js once\")"}' ``` ``` ### Technical Analysis The recommended setup registers a persistent OpenClaw cron job whose payload contains an `exec(...)` instruction. The task survives the initiating session and repeatedly executes a mutable JavaScript file from the user workspace. Scheduling is expected for a monitoring product, but the implementation uses a broad executable system-event payload rather than a narrowly scoped monitoring action. There is no integrity check for the target script, no immutable version pin, no expiration, and no removal command in the documented setup. Although `install.sh` does not automatically create the task, users are explicitly directed to establish it as the recommended deployment method. ### Attack Path 1. An administrator follows the recommended setup command. 2. OpenClaw stores a recurring task that survives the current session. 3. Every 30 seconds, the task submits a system event containing an `exec(...)` instruction. 4. The instruction executes `scripts/production-monitor.js` from a mutable workspace path. 5. If an attacker or another compromised process later replaces or modifies that file, the scheduler executes the altered code automatically. 6. Execution continues across future sessions until the cron entry is discovered and removed. ### Impact Assessment The scheduled process runs with the privileges of the OpenClaw ...[truncated 386 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make scheduled execution an explicit opt-in step and clearly describe its persistence and security implications. 2. Replace executable natural-language system events with a narrowly scoped scheduler action that invokes only the required dashboard operation. 3. Pin the invoked program to a reviewed, immutable version or verify its cryptographic hash before each execution. 4. Store executable files in a directory that cannot be modified by less-trusted processes. 5. Apply a least-privilege execution profile with restricted filesystem, network, environment, and OpenClaw-tool access. 6. Document commands to list, disable, and remove the scheduled task. 7. Require confirmation before registration and display the exact frequency, command, path, and permissions. 8. Use a sensible minimum update interval and implement an expiration or renewal policy where feasible. 9. Audit the target file before each deployment and after upgrades. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/discord-integration.js:208
• Finding: Unescaped Monitoring Data Is Written into Executable JavaScript<![CDATA[ ## Vulnerability Details **File Location**: `scripts/discord-integration.js:208-263` **Related Source Location**: `scripts/discord-integration.js:98-129` **Vulnerability Type**: Generated-code injection through an unescaped JavaScript template literal **Risk Level**: High ### Vulnerable Code Cron command output is converted into dashboard data without constraining characters that are meaningful in JavaScript template literals: ```javascript getCronJobs() { try { const cronText = execSync('openclaw cron list', { encoding: 'utf8', timeout: 5000 }); const lines = cronText.split('\\n').filter(line => line.trim()); return lines.slice(0, 5).map((line, index) => { const parts = line.trim().split(/\\s+/); return { id: parts[0] || `job_${index}`, name: this.truncateName(line), status: 'active', schedule: 'configured' }; }); } catch (error) { return [{ id: 'error', name: 'Cron fetch failed', status: 'error', schedule: 'unknown' }]; } } ``` The formatted output is then interpolated directly into generated source code: ```javascript generateOpenClawScript(data) { const message = this.formatDashboardMessage(data); return ` // OpenClaw session script for Discord integration const dashboardMessage = \`${message}\`; if (!process.env.LIVE_MESSAGE_ID) { // First time - post new message console.log('📝 Posting initial dashboard message...'); const result = message({ action: 'send', target: 'user:311529658695024640', message: dashboardMessage }); if (result.ok) { console.log('✅ Dashboard posted, message ID:', result.result.messageId); process.env.LIVE_MESSAGE_ID = result.result.messageId; } } else { // Update existing message ...[truncated 3058 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Stop generating executable JavaScript from runtime monitoring data. 2. Implement Discord posting in a fixed, reviewed module and pass dashboard content as ordinary data. 3. If serialization into JavaScript is unavoidable, encode the value with `JSON.stringify(message)` rather than embedding it in a template literal. 4. Reject or safely encode control characters, backticks, backslashes, `${` sequences, and unexpected Unicode control characters in externally influenced fields. 5. Parse structured JSON output from OpenClaw and enforce length and character constraints on job names. 6. Write generated data to a non-executable JSON file with restrictive permissions rather than to a `.js` file. 7. Do not instruct users or agents to execute dynamically generated source files. 8. Add tests using cron names containing backticks, `${...}`, quotes, newlines, and backslashes. 9. Run the Discord update component with narrowly scoped permissions so a formatting flaw cannot gain general command or tool execution. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (79)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Exfiltration Commands

High

• Category: Prompt Injection

Content

}

    /**
     * Post message to Discord via OpenClaw
     */
    async postMessage(content, channelId = null) {
        try {

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Exfiltration Commands

High

• Category: Prompt Injection

Content

async postMessage(content, channelId = null) {
        try {
            // This would use OpenClaw's message tool
            console.log(`📝 Would post message to ${channelId || 'default channel'}`);
            console.log('Content preview:', content.substring(0, 100) + '...');
            
            // Return simulated message ID

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly states that the skill sends monitoring data to Discord via outbound API calls, but it does not clearly warn users that system health, process, cron, and session/activity metadata will leave the host and be stored by a third-party service. This creates a real security/privacy risk because operators may deploy it without informed consent, potentially exposing sensitive operational details such as uptime, resource usage, process names, or agent activity to an external platform.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide recommends creating a cron job that runs every 30 seconds and triggers execution automatically, but it does not clearly warn users about persistent background activity or repeated outbound effects. This is dangerous because users may enable continuous automation without understanding that the skill will keep running and potentially sending updates indefinitely.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Method 2: Cron Job Integration (Recommended)

Create a cron job to run the dashboard automatically:

```bash
# Add this cron job to run every 30 seconds

• Confidence: 89% confidence
• Finding: This finding refers to the same cron job instruction that installs recurring background execution. The security concern is not that cron is inherently malicious, but that the skill promotes persistent automated execution without strong user warning, which increases the risk of long-lived unintended behavior and ongoing data transmission.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Method 2: Cron Job Integration (Recommended)

Create a cron job to run the dashboard automatically:

```bash
# Add this cron job to run every 30 seconds

• Confidence: 89% confidence
• Finding: This finding refers to the same cron job instruction that installs recurring background execution. The security concern is not that cron is inherently malicious, but that the skill promotes persistent automated execution without strong user warning, which increases the risk of long-lived unintended behavior and ongoing data transmission.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup guide describes sending and editing Discord messages containing dashboard data without a clear disclosure that monitored information will be transmitted to an external third-party service. In a monitoring context, the data may include system health, cron details, sessions, and performance metadata, so silent external transmission creates meaningful confidentiality and privacy risk.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dashboard-updater.js:35

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/debug-system.js:7

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/discord-integration.js:99

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dual-dashboard.js:40

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/integration.js:36

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/monitor.js:85

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/production-monitor.js:57

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/session-runner.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/sessions-dashboard.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/simple-dashboard.js:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/simple-system.js:11

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/system-health.js:11

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test-parsing.js:10