Security audit

Claw List

Security checks for vulnerabilities and agentic risk

Overview

This todo-list skill is purpose-aligned, but its bundled server has serious access-control and UI-safety problems that should be reviewed before installation.

Use this only on a trusted local or tightly controlled internal network until authentication, HTTPS guidance, and UI escaping are fixed. Do not store secrets, credentials, private conversation excerpts, or sensitive personal data in task notes, and treat anyone who can reach the API/UI as potentially able to read or change tasks and agent records.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server/api/main.py:77
Finding: Unauthenticated Administration and Spoofable Agent Identity
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: server/ui/index.html:575
Finding: Stored Cross-Site Scripting Through Untrusted API Data
Content: View full analysis
` ${a.display_name} ${a.agent_id} ${a.scope} scope delete `).join(''); ``` ```javascript const sel = document.getElementById('f-list-agent'); sel.innerHTML = agents.map(a => `${a.display_name}` ).join(''); ``` ```javascript tbody.innerHTML = lists.map(l => ` ${escHtml(l.name)} ${agentName(l.agent_id)} ${fmtDate(l.created_at)} open delete `).join(''); ``` ```javascript tbody.innerHTML = items.map(i => ` ${escHtml(i.title)}
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:12
Finding: Potentially Sensitive Conversation Data Can Be Sent Over Cleartext or to an Unrestricted Endpoint
Content: View full analysis
:8100` ``` ### Technical Analysis Network communication is necessary for the declared centralized task-management functionality, so this is not covert data exfiltration. However, the Skill explicitly permits an `http://` API URL and applies no destination allowlist or transport-security requirement. Task titles and notes may include conversation context, links, internal project details, or other sens ...[truncated 1647 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (18)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely broad and overlap with common conversational language such as "todo," "my tasks," and especially "the list." This increases the chance of accidental invocation in unrelated conversations, which can cause unintended reads or writes against the remote task API and create an unnecessary prompt-injection and action-trigger surface.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The skill exposes destructive API operations such as DELETE /lists/{id} without any described validation, ownership verification beyond a header, or user confirmation safeguards. If the agent is induced to supply an attacker-chosen or mistaken list ID, it could delete user data or act on the wrong resource.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
All requests require header `X-Agent-Id: {AGENT_ID}`. Base URL from `CLAW_LIST_URL`. Lists: `GET /lists` · `POST /lists {"name":"..."}` · `DELETE /lists/{id}` Items: `GET /lists/{id}/items` · `POST /lists/{id}/items` · `PUT /items/{id}` · `DELETE /items/{id}`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The item endpoints include PUT and DELETE by raw item ID, enabling direct modification or deletion of tasks if the agent is manipulated into using an incorrect or attacker-influenced identifier. In a natural-language skill with broad triggers, this creates a meaningful risk of unintended state changes and data loss.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
Lists: `GET /lists` · `POST /lists {"name":"..."}` · `DELETE /lists/{id}` Items: `GET /lists/{id}/items` · `POST /lists/{id}/items` · `PUT /items/{id}` · `DELETE /items/{id}` Item fields: `title` (required on create), `notes`, `priority` (1–5), `due_date`, `category`, `done`.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/api.md (reported line 41)May include surrounding context.
Delete list

text
DELETE /lists/{id}

Cascades to all items in the list. 403 if not owner.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/api.md (reported line 74)May include surrounding context.
Delete item

text
DELETE /items/{id}

403 if list belongs to another agent.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The admin endpoints are documented as requiring no X-Agent-Id and being intended for human/UI use, but no alternative authentication requirement is stated. Exposing DELETE /admin/agents/{agent_id} without documented authentication strongly suggests an unauthenticated or under-specified administrative capability that could let an attacker remove agent identities or disrupt service.
Content: Scanner excerpt · docs/api.md (reported line 128)May include surrounding context.
GET /admin/agents # list all agents POST /admin/agents # register agent (same as self-reg above) PUT /admin/agents/{agent_id} # update display_name and/or scope DELETE /admin/agents/{agent_id} # remove agent (does not delete their lists)

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/overview.md (reported line 148)May include surrounding context.
See server/README.md for full setup instructions. Quick summary:

bash
cp server/.env.example server/.env # Set POSTGRES_PASSWORD (required), CLAW_LIST_URL (informational) # Bundled Postgres:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/README.md (reported line 14)May include surrounding context.
Environment

bash
cp .env.example .env

Edit .env:

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
# Claw-List Manage todo lists via a central API. Trigger on: "the list", "show me the list", "todo", "add task", "add to my list", "mark done", "mark complete", "what's due", "my tasks", "create a list". ## Config

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly recommends storing 'conversation context' in the free-text notes field without warning about privacy, minimization, or secrets handling. In an agent setting, conversation context can contain sensitive user data, credentials, internal prompts, or personal information, so this guidance increases the likelihood of inappropriate data retention and later disclosure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/overview.md (reported line 5)May include surrounding context.
md
Self-hosted todo/task management for OpenClaw agents. Agents manage tasks via a REST API using `web_fetch` — no direct database access, no credentials in agent context. A web UI provides human oversight across all agents and lists. This is a full rewrite of v1, which had agents writing directly to PostgreSQL via a Python CLI bundled with the skill. ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to activate on common conversational language such as 'todo' or 'my tasks', which can cause the skill to run unexpectedly. Because the skill can create or modify task records and store conversation-derived content, accidental invocation may result in unintended data transmission or persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The overview states that agents may store conversation context, links, or references in the notes field, but it does not present this as a clear user-facing warning about data persistence and transmission. This creates a privacy risk because users may reveal sensitive information believing it remains ephemeral, when it may instead be stored in the backend and exposed through the UI to authorized viewers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly instructs users to bind both the API and UI to 0.0.0.0, making them reachable from the network, but does not warn about the exposure or require authentication, firewalling, or TLS. In a system intended for agent connectivity and human oversight, this can lead operators to unintentionally publish administrative or sensitive services beyond localhost, increasing the attack surface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The UI selects an all-scope agent if available, but otherwise falls back to any registered agent and then uses that agent's X-Agent-Id to request /lists. In an admin-style interface that manages multiple agents and their scopes, this can enable unauthorized cross-agent data access if the backend trusts the supplied agent context or exposes all lists through that endpoint, making the UI logic inconsistent with the stated permission model.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document declares lang="en", which fixes the interface language to English. Under the stated policy, forcing a specific language without user opt-in or documented regional justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: toLocaleDateString('en-GB', ...) explicitly forces British English date formatting for all users. This is a locale policy violation unless the skill offers user opt-in or clearly documents a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Vague Triggers

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Delete list

Tool Parameter Abuse

Delete item

Tool Parameter Abuse

Credential Access

Credential Access

Environment

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

Session Persistence

Missing User Warnings

Session Persistence

Vague Triggers

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis