Security audit

pane

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Pane integration, but it grants deferred execution and broad agent memory/session sync powers that deserve manual review before installation.

Install only if you trust Pane Gateway and the publisher with access to your local Pane sessions and OpenClaw agent identity, memory, and log files. Avoid granting the token in environments with sensitive agent history unless you are comfortable with broad sync and deferred follow-up behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill introduces a generic cron-scheduling workflow using `openclaw cron add`, which extends behavior beyond simply operating Pane through its local Gateway. This gives the skill a persistence/deferred-execution capability that could be abused to continue acting after the initial user turn, increasing the risk of unreviewed follow-up actions or hidden task chaining.

Description-Behavior Mismatch

Low

Confidence: 88% confidence
Finding: The skill is presented as a Pane Gateway integration, but it also exposes a raw `/v1/chat/completions` proxy that operates outside Pane sessions. This broadens the skill's effective authority and creates a mismatch between declared scope and actual capability, which can surprise users and bypass Pane-session visibility expectations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The reference materially expands the skill’s reachable capabilities beyond the user-facing description, including agent enumeration, model listing, chat completion proxying, metrics access, and file sync. That scope mismatch can mislead users and higher-level policy layers, increasing the chance of unintended data access or misuse through undocumented features.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The text says 'Identity-file sync only' but the allowlist includes memory and logs files, which may contain sensitive internal state, prompts, or prior activity. This misleading labeling understates the sensitivity of accessible data and may cause operators or users to authorize broader access than intended.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The API reference states that notes/tasks/projects endpoints do not exist and instructs callers to use conversational session flows instead, directly conflicting with the skill’s advertised purpose. This substitution is dangerous because free-form chat actions are harder to constrain, validate, and audit than dedicated typed endpoints, enabling unintended operations or prompt-driven abuse.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Documenting destructive DELETE operations without confirmation guidance encourages integrations to perform irreversible session deletion with minimal friction. In an agent context, that raises the risk of accidental or prompt-induced data loss because the model may invoke deletion without explicit user intent verification.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: `/v1/sync/push` writes agent files and can overwrite stored identity, memory, or operational files, yet the reference lacks overwrite and integrity risk warnings beyond checksum formatting. In this skill context, modifying agent memory/identity files can alter future agent behavior, leak secrets, or persist malicious instructions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The bulk sync endpoint returns allowlisted file contents for all agents, which may expose identities, memory, logs, and other sensitive operational context in one call. Without strong privacy warnings or minimization guidance, an agent using this skill could over-collect confidential data far beyond the user’s immediate task.

Static analysis

No suspicious patterns detected.