Security audit
Security checks across malware telemetry and agentic risk
This is a real OpenClaw management dashboard, but it exposes powerful agent, skill, config, and network-changing controls without clear access protection.
Install only if you intend to run a powerful local admin dashboard for OpenClaw. Keep it bound to localhost, do not run the firewall-opening helper unless you understand the LAN exposure, review any skill installation before using it, and assume the dashboard can modify agents, skills, OpenClaw configuration, and local model credential copies. VirusTotal was pending and was not used as a negative signal.
if command -v ufw &> /dev/null; then
echo ""
echo "检测到 ufw 防火墙，正在开放端口..."
sudo ufw allow from 192.168.0.0/16 to any port $PORT comment 'Dashboard LAN access'
sudo ufw reload
echo "✅ ufw 规则已添加"
fiecho ""
echo "检测到 ufw 防火墙，正在开放端口..."
sudo ufw allow from 192.168.0.0/16 to any port $PORT comment 'Dashboard LAN access'
sudo ufw reload
echo "✅ ufw 规则已添加"
fi# 同时添加到 iptables
echo ""
echo "添加 iptables 规则..."
sudo iptables -C INPUT -p tcp --dport $PORT -j ACCEPT 2>/dev/null || {
sudo iptables -I INPUT -p tcp --dport $PORT -j ACCEPT
echo "✅ iptables 规则已添加"
}echo ""
echo "添加 iptables 规则..."
sudo iptables -C INPUT -p tcp --dport $PORT -j ACCEPT 2>/dev/null || {
sudo iptables -I INPUT -p tcp --dport $PORT -j ACCEPT
echo "✅ iptables 规则已添加"
}flask>=2.0.0 werkzeug>=2.0.0
flask>=2.0.0 werkzeug>=2.0.0
GET /api/agents # List all agents POST /api/agents # Create new agent GET /api/agents/<name> # Get agent details DELETE /api/agents/<name> # Delete agent GET /api/skills # List all skills GET /api/agents/<name>/skills # Get agent skills POST /api/agents/<name>/skills/<id>/enable
66/66 vendors flagged this skill as clean.
Detected: suspicious.install_untrusted_source