Security audit

Claw Insights Snapshot

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local status-card helper, but users should treat generated cards and JSON as potentially sensitive operational telemetry.

Install only if you are comfortable exposing OpenClaw operational status to the agent using it. Keep authentication enabled unless the service is strictly local, do not expose no-auth mode on a network, and review cards or JSON before posting them to shared or third-party channels.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documentation explicitly advises running the service in `--no-auth` mode and omitting the Authorization header, but provides no warning about the risk of exposing an unauthenticated endpoint. If the service is reachable beyond localhost or misconfigured, an attacker could retrieve sensitive status snapshots and raw metrics without credentials.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill encourages generating and sharing agent status cards and raw metrics to chat channels and files, but it does not warn that snapshots may contain operationally sensitive data such as token usage, session activity, error counts, and gateway health. This can lead users to disclose internal telemetry to third-party platforms or broad audiences without realizing the privacy and security implications.

External Transmission

Medium

Category: Data Exfiltration
Content: ## REST API ```bash curl -X POST http://127.0.0.1:41041/api/snapshot \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"detail":"standard","range":"6h","theme":"dark"}' \
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: ```bash # 1. Generate a compact status card curl -X POST http://127.0.0.1:41041/api/snapshot \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"detail":"compact","range":"6h"}' \
Confidence: 88% confidence
Finding: This workflow explicitly prepares a status card for sending to messaging channels such as Slack, Telegram, Discord, or WhatsApp, but does not warn that the image may expose internal operational data to third-party services and unintended recipients. The context makes the transmission risk more concrete than a generic local generation example because the stated goal is distribution beyond the local system.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## Field Notes | Field | When null | Notes | | --------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `gateway` | Gateway unreachable | `version` is the Claw Insights app version (not gateway CLI version). Includes CPU/memory of the gateway process. | | `channels` | No channels configured | Provider names: telegram, discord, slack, etc. |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Field | When null | Notes | | --------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `gateway` | Gateway unreachable | `version` is the Claw Insights app version (not gateway CLI version). Includes CPU/memory of the gateway process. | | `channels` | No channels configured | Provider names: telegram, discord, slack, etc. | | `summary` | No data for range | `tokensDisplay` is pre-formatted (e.g. "1.2k") | | `tokensByModel` | No token data | Sorted by usage descending, `percent` sums to 100 | | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Field | When null | Notes | | --------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `gateway` | Gateway unreachable | `version` is the Claw Insights app version (not gateway CLI version). Includes CPU/memory of the gateway process. | | `channels` | No channels configured | Provider names: telegram, discord, slack, etc. | | `summary` | No data for range | `tokensDisplay` is pre-formatted (e.g. "1.2k") | | `tokensByModel` | No token data | Sorted by usage descending, `percent` sums to 100 | | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `gateway` | Gateway unreachable | `version` is the Claw Insights app version (not gateway CLI version). Includes CPU/memory of the gateway process. | | `channels` | No channels configured | Provider names: telegram, discord, slack, etc. | | `summary` | No data for range | `tokensDisplay` is pre-formatted (e.g. "1.2k") | | `tokensByModel` | No token data | Sorted by usage descending, `percent` sums to 100 | | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` | | `recentErrors` | No errors in range | Only present when `detail=standard` or `full` | | `buckets` | No metrics data | Time-series bins for charts. All fields optional: `sessions` (peak), `tokensK`/`tokens` (sum), `errors`/`warnings` (sum), `uptimePercent` (min) |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `channels` | No channels configured | Provider names: telegram, discord, slack, etc. | | `summary` | No data for range | `tokensDisplay` is pre-formatted (e.g. "1.2k") | | `tokensByModel` | No token data | Sorted by usage descending, `percent` sums to 100 | | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` | | `recentErrors` | No errors in range | Only present when `detail=standard` or `full` | | `buckets` | No metrics data | Time-series bins for charts. All fields optional: `sessions` (peak), `tokensK`/`tokens` (sum), `errors`/`warnings` (sum), `uptimePercent` (min) | | `_meta` | All sources healthy | Lists degraded data sources for transparency |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `summary` | No data for range | `tokensDisplay` is pre-formatted (e.g. "1.2k") | | `tokensByModel` | No token data | Sorted by usage descending, `percent` sums to 100 | | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` | | `recentErrors` | No errors in range | Only present when `detail=standard` or `full` | | `buckets` | No metrics data | Time-series bins for charts. All fields optional: `sessions` (peak), `tokensK`/`tokens` (sum), `errors`/`warnings` (sum), `uptimePercent` (min) | | `_meta` | All sources healthy | Lists degraded data sources for transparency |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `sessions` | No active sessions | Includes sub-agent tree when `detail=full` | | `recentErrors` | No errors in range | Only present when `detail=standard` or `full` | | `buckets` | No metrics data | Time-series bins for charts. All fields optional: `sessions` (peak), `tokensK`/`tokens` (sum), `errors`/`warnings` (sum), `uptimePercent` (min) | | `_meta` | All sources healthy | Lists degraded data sources for transparency | ## Example Response
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.