OpenClaw PC Control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:26 AM UTC
• Version: 2.0.0

Overview

This is a real remote-control skill for a Windows PC, but its authentication and safety boundaries are too weak for the level of access it exposes.

Only install this in an isolated test environment unless the maintainer fixes the default shared API key, loopback binding, TLS/auth model, security-mode downgrade endpoint, file sandbox, shell validation, and browser security flags. Treat the current package as capable of exposing or controlling the whole logged-in Windows session if the service is reachable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security_config.json:1

Finding

Packaged Plaintext API Credential Enables Unauthorized Remote Control

Content

View full analysis

`. 6. The attacker invokes privileged endpoints such as `/file/read`, `/clipboard/read`, `/shell/run`, `/browser/js`, or `/security/mode`. 7. The attacker gains remote control within the privileges of the API server process. ### Impact Assessment A successful attacker can access sensitive files and clipboard data, capture the screen, inject keyboard and mouse input, terminate processes, manipulate windows, automate a browser, and execute operating-system commands. The scope is the entire interactive user session and every resource accessible to the account running the API. Because the credential has already been distributed in plainte ...[truncated 101 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api.py:530

Finding

Remote-Control API Is Exposed on All Interfaces Without Transport Encryption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/modules/security.py:280

Finding

Shell Allowlist Can Be Bypassed Through Command Chaining

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/modules/security.py:297

Finding

File Sandbox Does Not Confine Access to an Approved Root

Content

View full analysis

tuple[bool, str]: """ 检查文件路径是否安全 Returns: (是否允许, 拒绝原因) """ if not config.is_enabled or not config.file_sandbox_enabled: return True, "" try: abs_path = os.path.abspath(file_path) except Exception as e: log_operation("file_blocked", {"path": file_path, "operation": operation}, False, f"路径解析失败: {e}") return False, f"路径解析失败: {e}" path_lower = abs_path.lower() for blocked in config.file_blocked_dirs: if blocked.lower() in path_lower: log_operation("file_blocked", {"path": file_path, "operation": operation}, False, f"路径包含禁止目录: {blocked}") return False, f"路径包含禁止目录: {blocked}" for pattern in config.file_blocked_patterns: if re.search(pattern, abs_path, re.IGNORECASE): log_operation("file_blocked", {"path": file_path, "operation": operation}, False, f"路径匹配禁止模式: {pattern}") return False, f"路径匹配禁止模式: {pattern}" if config.file_allowed_dirs: allowed = False for allowed_dir in config.file_allowed_dirs: if path_lower.startswith(allowed_dir.lower()): allowed = True break if not allowed: log_operation("file_blocked", {"path": file_path, "operation": operation}, False, "路径不在允许目录列表中") return False, "路径不在允许目录列表中" log_operation("file_allowed", {"path": file_path, "operation": operation}, True) return True, "" ``` The supplied configuration disables allowlist enforcement by leaving it empty in `scripts/security_config.json:38-40`: ```json "file": { "enabled": true, "allowed_dirs": [], "blocked_dirs": [ ``` ### Technical Analysis T ...[truncated 1964 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/api.py:469

Finding

Authenticated Remote Users Can Persistently Disable All Security Controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api.py:154

Finding

Screenshot Output Path Bypasses File Sandbox Validation

Content

View full analysis

`. 4. The API passes that path directly to `mss.shot`. 5. Screenshot bytes are written at the chosen location without sandbox validation. 6. Existing files may be replaced where the underlying library and filesystem permissions permit. ### Impact Assessment The attacker can create or overwrite files writable by the API process with screenshot image data. This ca ...[truncated 284 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/modules/browser.py:43

Finding

Automated Browser Disables Core Web and Certificate Security Controls

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Dependencies Make Builds Non-Reproducible and Increase Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个远程PC控制技能，核心能力应是直接操作Windows电脑。实际代码则是一个配套的安全控制模块，主要负责限制和审计潜在的PC操作行为，而不是执行这些操作本身。虽然安全模块可能是PC控制系统的支持性组成部分，但就该代码片段本身而言，其主要目的与声明的主要用途不一致；同时它还包含声明中未提到的认证、沙箱和日志能力。因此该描述不能准确代表这段代码的实际行为。

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises remote-control, screenshot, file management, browser automation, process management, and shell execution capabilities without prominent user-facing warnings about privacy, system integrity, and destructive potential. In this context, the lack of explicit warnings and consent boundaries is especially dangerous because the skill can access sensitive data, alter the host, and execute commands on a real Windows machine.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

| `scripts/security_config.json` | 安全配置文件 |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document describes destructive capabilities including killing processes, closing windows, writing files, and executing shell commands without any warning, approval flow, or operational boundaries. In a remote PC-control tool, these functions enable denial of service, data loss, arbitrary code execution, and system compromise if misused or exposed to an untrusted agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The /shell/run and /shell/run-file endpoints execute commands or scripts, which are safety-critical operations. This file exposes them without any confirmation prompt, user-facing warning, or explanatory comment/docstring indicating that arbitrary shell commands may be run on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Script execution is exposed without explicit user disclosure, and PowerShell is launched with ExecutionPolicy Bypass, which suppresses an important user/system safeguard. In this skill's context, that combination is especially dangerous because it enables covert execution of complex payloads on a remote Windows host with very high abuse potential.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes highly sensitive capabilities including remote file access, file modification, and shell execution, but the manifest declares no explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations increases the chance that the skill is invoked more broadly than intended and makes it harder for policy layers or users to understand and constrain what the skill can do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad terms like '截图', '键盘', '鼠标', and '浏览器', which are likely to match ordinary user requests and can cause accidental activation of a remote-control skill. Because this skill can manipulate a Windows PC, mistaken routing could lead to unintended screenshots, input injection, file operations, or shell actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes screenshot and clipboard-read capabilities that can directly access highly sensitive user data such as passwords, tokens, messages, or on-screen documents, yet it provides no safety guidance, consent requirements, or usage restrictions. In the context of a remote PC-control skill, these are surveillance-grade capabilities and become especially dangerous because they can be triggered over an HTTP API without any documented safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-doc.md (reported line 24)May include surrounding context.

python pc.py screenshot [--path 保存路径]

text

```bash
curl "http://localhost:8080/screenshot?path=my.png"

屏幕信息

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-doc.md (reported line 203)May include surrounding context.

text

```bash
curl -X POST "http://localhost:8080/shell/run" -H "Content-Type: application/json" \
  -d '{"command":"Get-Process","shell":"powershell","timeout":30}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language strings throughout the file, including API descriptions, errors, and CLI prompts, are presented in Chinese only. The file does not offer a language choice or document that the skill is intentionally limited to a Chinese-speaking locale, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The middleware explicitly skips authentication entirely when security is disabled or no API key is configured, yet this API exposes highly sensitive capabilities such as screenshots, keyboard/mouse control, file access, process management, browser automation, and shell execution. In the context of a remote PC control service, allowing all endpoints to become public due to missing configuration creates unauthenticated remote takeover risk, not just a documentation mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The /file/write endpoint performs file modification, which is a safety-critical operation for code files. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring warning that the API can alter files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The menu and mode descriptions claim that 'standard' mode includes sandbox protection, but this file enforces no mode-specific restrictions on dangerous operations like shell execution, file write/read, process kill, or device control. This creates a false sense of safety and may cause operators to expose a service believing protections exist when the API still offers near-full remote host control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This module enables powerful browser automation primitives—navigation, clicks, text entry, screenshots, and arbitrary JavaScript execution—without any authorization boundary, allowlist, confirmation gate, or policy enforcement. In the context of a remote PC-control skill, these capabilities can directly drive sensitive web sessions, bypass browser safety cues, submit forms, manipulate authenticated sites, and extract page data, making abuse materially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This module provides unrestricted clipboard read and write capabilities, allowing access to potentially sensitive user data such as passwords, tokens, copied documents, or cryptocurrency addresses. In the context of a remote PC-control skill, clipboard access materially increases surveillance and tampering risk because it can silently exfiltrate data or replace clipboard contents without any confirmation, logging, or access control.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring is written entirely in Chinese and all user-facing error messages in this file are also Chinese, indicating a fixed language choice. The policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified regional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This module directly exposes functions to press keys, type arbitrary text, and send hotkeys on the host machine with no built-in authorization gate, visibility control, or confirmation step. In the context of a remote PC-control skill, these primitives can be chained to execute commands, approve dialogs, manipulate applications, or exfiltrate data, making unauthorized use highly dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This module exposes direct mouse movement, clicking, dragging, and scrolling primitives that can control a user's desktop without any built-in confirmation, authorization check, safety interlock, or visibility mechanism. In the context of a remote PC-control skill, these actions can be chained to approve prompts, manipulate files, trigger downloads, or interfere with user activity, making unauthorized or unsafe system interaction materially easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module exposes a destructive process-kill capability that can terminate processes by name without any user-facing confirmation, approval workflow, or additional safety gate in this function. In the context of a remote PC-control skill, this increases the risk of accidental or unauthorized disruption of user applications, data loss, or denial of service if the caller supplies a sensitive process name.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function captures the user's screen and writes the image to disk without any built-in consent check, warning, or visibility mechanism. In a remote PC-control skill, silent screenshot capture can expose highly sensitive information such as credentials, private messages, financial data, or internal documents, making the context significantly more dangerous than a normal local utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module persists the API key in plaintext when saving the security configuration ('api_key': self.api_key or ''), which means any local user, malware, backup system, or accidental file disclosure can recover the credential directly. In a remote PC-control skill that can execute shell commands and manage files/processes, compromise of this key could enable unauthorized control of the host and effectively disable the intended access boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module exposes shell command execution as a callable capability without any visible user-facing warning, consent, or confirmation workflow. In a remote PC-control skill, this materially increases the risk of silent destructive actions because an operator or compromised agent can execute system commands without the device owner's informed approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.