Live Monitoring Dashboard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:51 AM UTC
• Version: 2.0.0

Overview

This monitoring skill is understandable in purpose, but it ships hard-coded Discord destinations, direct bot-token use, and persistent automation patterns that could send host activity data outside the user's control.

Review carefully before installing. Replace all Discord channel, message, guild, and user IDs with your own verified destination, avoid running zero-token-dashboard-v2.sh unless you accept direct bot-token handling, and do not add the recommended cron job until you understand that it will run repeatedly and may publish system/OpenClaw metadata to Discord. Prefer a least-privilege bot/channel, local-only dry runs, and removal instructions for any scheduled task.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/zero-token-dashboard.sh:9

Finding

System Monitoring Data Is Sent to Hard-Coded Discord Destinations

Content

View full analysis

/dev/null || true } ``` The generated Discord integration also contains a fixed user recipient: ```javascript if (!process.env.LIVE_MESSAGE_ID) { const result = message({ action: 'send', target: 'user:311529658695024640', message: dashboardMessage }); } ``` ### Technical Analysis The dashboard collects information about OpenClaw processes, cron jobs, host resource utilization, and uptime. Instead of requiring the installer to provide and verify a destination, multiple scripts ship with fixed Discord user, channel, and message identifiers. Consequently, executing the default scripts can edit messages in a preselected Discord channel or send monitoring data to a preselected user. The scripts do not verify that the identifiers belong to the installer, that the installer approved the recipient, or that the destination is part of the current OpenClaw deployment. The repeated use of the same identifiers in scripts and state files makes this an operational default rather than an isolated documentation example. ### Attack Path 1. A user installs the Skill and retains the shipped configuration. 2. The dashboard runs manually or through a scheduled task. 3. ...[truncated 1018 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/zero-token-dashboard-v2.sh:10

Finding

Dashboard Variant Reads the Global OpenClaw Discord Bot Token

Content

View full analysis

&2 return 1 fi jq -r '.channels.discord.token // empty' "$CONFIG_FILE" } BOT_TOKEN=$(get_bot_token) if [ -z "$BOT_TOKEN" ]; then echo "$(date): ERROR — Could not extract Discord bot token" >&2 exit 1 fi # Discord REST API edit — direct PATCH, no CLI dependency update_discord_message() { local msg_id="$1" local content="$2" local json_content json_content=$(printf '%s' "$content" | jq -Rsa .) local response response=$(curl -s -w "\n%{http_code}" -X PATCH \ "https://discord.com/api/v10/channels/${CHANNEL_ID}/messages/${msg_id}" \ -H "Authorization: Bot ${BOT_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"content\": ${json_content}}") } ``` ### Technical Analysis This script reads the global OpenClaw configuration file and extracts the Discord bot token in plaintext. It then bypasses the scoped OpenClaw messaging interface and uses the token directly against the Discord REST API. A monitoring dashboard only needs authority to update its designated messages. Access to the underlying bot credential grants all Discord permissions assigned to that bot, which may cover substantially more channels and operations than the dashboard requires. Direct token handling also increases the likelihood of credential disclosure through debugging, process instrumen ...[truncated 1349 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SETUP.md:25

Finding

Recommended Setup Creates Recurring Cross-Session Command Execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/discord-integration.js:208

Finding

Unescaped Monitoring Data Is Written into Executable JavaScript

Content

View full analysis

line.trim()); return lines.slice(0, 5).map((line, index) => { const parts = line.trim().split(/\\s+/); return { id: parts[0] || `job_${index}`, name: this.truncateName(line), status: 'active', schedule: 'configured' }; }); } catch (error) { return [{ id: 'error', name: 'Cron fetch failed', status: 'error', schedule: 'unknown' }]; } } ``` The formatted output is then interpolated directly into generated source code: ```javascript generateOpenClawScript(data) { const message = this.formatDashboardMessage(data); return ` // OpenClaw session script for Discord integration const dashboardMessage = \`${message}\`; if (!process.env.LIVE_MESSAGE_ID) { // First time - post new message console.log('📝 Posting initial dashboard message...'); const result = message({ action: 'send', target: 'user:311529658695024640', message: dashboardMessage }); if (result.ok) { console.log('✅ Dashboard posted, message ID:', result.result.messageId); process.env.LIVE_MESSAGE_ID = result.result.messageId; } } else { // Update existing message ...[truncated 3058 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (79)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Editing specific Discord messages in a hardcoded channel without declared permissions would create an unauthorized outbound telemetry path. The risk is amplified here because the skill claims real-time system and session monitoring, so any hidden external posting could expose sensitive operational metadata continuously.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/integration.js (reported line 95)May include surrounding context.

js

}

    /**
     * Post message to Discord via OpenClaw
     */
    async postMessage(content, channelId = null) {
        try {

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/integration.js (reported line 100)May include surrounding context.

js

async postMessage(content, channelId = null) {
        try {
            // This would use OpenClaw's message tool
            console.log(`📝 Would post message to ${channelId || 'default channel'}`);
            console.log('Content preview:', content.substring(0, 100) + '...');
            
            // Return simulated message ID

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly states that the skill sends monitoring data to Discord via outbound API calls, but it does not clearly warn users that system health, process, cron, and session/activity metadata will leave the host and be stored by a third-party service. This creates a real security/privacy risk because operators may deploy it without informed consent, potentially exposing sensitive operational details such as uptime, resource usage, process names, or agent activity to an external platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide recommends creating a cron job that runs every 30 seconds and triggers execution automatically, but it does not clearly warn users about persistent background activity or repeated outbound effects. This is dangerous because users may enable continuous automation without understanding that the skill will keep running and potentially sending updates indefinitely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This finding refers to the same cron job instruction that installs recurring background execution. The security concern is not that cron is inherently malicious, but that the skill promotes persistent automated execution without strong user warning, which increases the risk of long-lived unintended behavior and ongoing data transmission.

Content

Scanner excerpt · SETUP.md (reported line 26)May include surrounding context.

Method 2: Cron Job Integration (Recommended)

Create a cron job to run the dashboard automatically:

bash

# Add this cron job to run every 30 seconds

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This finding refers to the same cron job instruction that installs recurring background execution. The security concern is not that cron is inherently malicious, but that the skill promotes persistent automated execution without strong user warning, which increases the risk of long-lived unintended behavior and ongoing data transmission.

Content

Scanner excerpt · SETUP.md (reported line 26)May include surrounding context.

Method 2: Cron Job Integration (Recommended)

Create a cron job to run the dashboard automatically:

bash

# Add this cron job to run every 30 seconds

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup guide describes sending and editing Discord messages containing dashboard data without a clear disclosure that monitored information will be transmitted to an external third-party service. In a monitoring context, the data may include system health, cron details, sessions, and performance metadata, so silent external transmission creates meaningful confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dashboard-updater.js:35

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/debug-system.js:7

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/discord-integration.js:99

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dual-dashboard.js:40

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/integration.js:36

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/monitor.js:85

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/production-monitor.js:57

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/session-runner.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/sessions-dashboard.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/simple-dashboard.js:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/simple-system.js:11

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/system-health.js:11

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/test-parsing.js:10