Security audit

Mission Control

Security checks for vulnerabilities and agentic risk

Overview

Mission Control is a coherent dashboard skill, but it needs human review because its default app exposes powerful unauthenticated management and agent-dispatch paths.

Install only in a trusted local environment unless you first enable real authentication, bind services to loopback or a protected network, use HTTPS/WSS for non-local traffic, and review the agent-dispatch and Library rendering behavior. Do not expose the Docker deployment or backend API to a LAN or the internet with the shipped defaults.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: setup.sh:246
Finding: Management API Is Unauthenticated by Default
Content: View full analysis
"$ENV_FILE" < { if (req.path === "/events/stream" || req.path === "/health") return next(); if (req.path.startsWith("/hooks/") && req.headers["x-hook-secret"] === process.env.HOOK_SECRET) return next(); const auth = req.headers.authorization; if (!auth || auth !== `Bearer ${token}`) { return res.status(401).json({ error: "Unauthorized" }); } next(); }); } ``` ### Technical Analysis Authentication middleware is installed only when both `AUTH_MODE` equals `loca ...[truncated 2056 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: app/backend/src/services/dispatcher.js:51
Finding: Untrusted Dashboard Content Is Converted into Agent Instructions
Content: View full analysis
{ if (res.ok) { console.log(`[dispatcher] ${event} → ${targetAgent} via /hooks/agent (${res.status})`); if (pendingId) { try { db.prepare("DELETE FROM pending_dispatches WHERE id = ?").run(pendingId); } catch {} } } else { console.warn(`[dispatcher] /hooks/agent ${res.status} for ${event} — falling back to WS`); trySendViaWS(targetAgent, agentMessage, event); } }).catch(err => { console.warn(`[dispatcher] /hooks/agent failed: ${err.message} — falling back to WS`); trySendViaWS(targetAgent, agentMessage, event); }); } ``` Representative message construction: ```js case "mc:project_kickoff": return [ `[Mission Control] New project "${p.projectName}" has been approved and needs task planning.`, `Project ID: ${p.projectId}`, `Priority: ${p.priority || "medium"}`, p.description ? `Description: ${p.description}` : null, ``, `ACTION REQUIRED: Break this project into tasks.`, `For each task, POST to /api/tasks with:`, ` { "project_id": "${p.proje ...[truncated 3174 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: setup.sh:119
Finding: Setup Guidance Recommends Unverified Remote Script Execution
Content: View full analysis
/dev/null; then success "OpenClaw CLI found" else warn "OpenClaw CLI not found. The hook won't auto-enable." warn "Install OpenClaw: curl -fsSL https://openclaw.ai/install.sh | bash" fi ``` ### Technical Analysis The setup script prints an installation command that pipes mutable content fetched over HTTPS directly into `bash`. The downloaded script is not pinned to a version or commit and is not checked against a cryptographic digest or trusted signature. Although `setup.sh` does not automatically execute the command, it presents it as the recommended remediation when OpenClaw is absent. A user following the installation flow would execute code that was not included in the audited project and whose behavior can change after this Skill has been reviewed. HTTPS protects transport under normal conditions but does not protect against compromise of the hosting account, domain, release infrastructure, or the remote script itself. ### Attack Path 1. OpenClaw is absent when the user runs `setup.sh`. 2. The setup output instructs the user to run the displayed `curl | bash` command. 3. The remote domain, installer publication process, DNS/TLS trust path, or hosting account is compromised, or the remote script is changed unexpectedly. 4. `curl` retrieves the current remote content. 5. The shell executes that content immediately without giving the user an opportunity to inspect it or verify its integrity. 6. The payload executes with the privileges of the user running the command. ### Impact Assessment A compromised installer can perform arbitrary actions available to the invoking user, including: - Reading or modifying files in the user’s account. - Accessing OpenClaw configuration and locally stored credentials. - Insta ...[truncated 273 chars]
Remediation: View remediation
openclaw-install.sh" | sha256sum -c - less openclaw-install.sh bash openclaw-install.sh ``` 5. Document the expected files, permissions, network destinations, and persistence changes made by the installer. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: app/frontend/src/lib/MarkdownRenderer.jsx:101
Finding: Regex-Based HTML Sanitization Allows Stored Cross-Site Scripting Bypasses
Content: View full analysis
)<[^<]*)*<\/script>/gi, "") .replace(/\s*on\w+\s*=\s*["'][^"']*["']/gi, "") .replace(/\s*on\w+\s*=\s*\S+/gi, "") .replace(/javascript\s*:/gi, "") .replace(/<\s*\/?\s*(iframe|embed|object|form|base|meta|link)\b[^>]*>/gi, ""); } ``` ```jsx switch (format) { case "json": return renderJSON(content); case "csv": return renderCSV(content); case "code": case "text": { const escaped = content .replace(/&/g, "&") .replace(//g, ">"); return `
text
${escaped}
`; } case "html": return stripDangerousHtml(content); case "markdown": default: return stripDangerousHtml(marked.parse(content)); } return (
); ``` Backend safety-net filtering: ```js export function stripDangerous(str) { if (typeof str !== "string") return str; return str .replace(/)<[^<]*)*<\/script>/gi, "") .replace(/\s*on\w+\s*=\s*["'][^"']*["']/gi, "") .replace(/\s*on\w+\s*=\s*\S+/gi, "") .replace(/javascript\s*:/gi, "") .replace(/data\s*:\s*text\/html/gi, "") .replace(/<\s*\/?\s*(iframe|embed|object|form|base|meta|link)\b[^>]*>/gi, "") .replace(/style\s*=\s*["'][^"']*expressio ...[truncated 2432 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: hook.ts:33
Finding: Sensitive Lifecycle and Gateway Data May Be Sent over Plaintext Connections
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (126)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill includes undeclared operational setup behavior in metadata, notably npm-based package installation and environment configuration, while the description presents it mainly as an API/event usage guide. Hidden install/runtime side effects can cause an agent or operator to grant broader execution and filesystem access than expected, which is risky in a skill ecosystem where packages may run install scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The route deletes documents directly from the database and broadcasts the deletion, but provides no confirmation, warning, or user disclosure in code comments or output. Because this is an irreversible destructive operation, the absence of any visible warning meets the missing-user-warning criteria for code files.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: app/backend/src/services/dispatcher.js:51

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: app/test-dispatcher.js:26

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: hook.ts:33