Tidbyt Status Display

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:13 PM UTC
• Version: 1.0.0

Overview

The skill matches its Tidbyt status-display purpose, but it exposes OpenClaw activity metadata over an unauthenticated network service by default.

Install only if you are comfortable exposing agent activity metadata for a Tidbyt display. Prefer binding the API to 127.0.0.1 or a trusted interface, avoid broad firewall rules, add authentication before LAN or internet exposure, and enable systemd/background persistence only after deciding how the endpoint will be stopped and protected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/status_server.py:100

Finding

Unauthenticated Network Exposure of Agent Activity Metadata

Content

View full analysis

Vulnerability Details

File Location: scripts/status_server.py:100-112
Supporting Locations: scripts/status_server.py:16-17, SKILL.md:156-163
Vulnerability Type: Unauthenticated information exposure caused by an overly broad network binding and permissive CORS policy
Risk Level: Medium

Vulnerable Code

python

def do_GET(self):
    if self.path == "/status" or self.path == "/":
        status = get_openclaw_status()
        
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Access-Control-Allow-Origin", "*")
        self.end_headers()
        
        self.wfile.write(json.dumps(status, indent=2).encode())
    else:
        self.send_response(404)
        self.end_headers()


def main():
    port = int(os.environ.get("PORT", 8765))
    
    server = HTTPServer(("0.0.0.0", port), StatusHandler)

The exposed information is derived from OpenClaw session metadata:

python

workspace = Path.home() / ".openclaw"
sessions_dir = workspace / "agents" / "main" / "sessions"

The documentation additionally recommends allowing network access to the service:

bash

sudo ufw allow 8765/tcp

Technical Analysis

The HTTP service binds to 0.0.0.0, making it reachable through every available network interface rather than only the loopback interface. Neither / nor /status performs authentication or authorization before returning status information.

The response includes agent state, activity timestamps, active sub-agent task counts, and descriptive activity text. Although the implementation only examines session filenames and modification times and does not read session contents, the resulting metadata can disclose when a user or agent is active, idle, or processing concurrent tasks.

The Access-Control-Allow-Origin: * response header also permits scripts hosted by arbitrary web o ...[truncated 2160 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind to loopback by default:

   python

   bind_address = os.environ.get("BIND_ADDRESS", "127.0.0.1")
   server = HTTPServer((bind_address, port), StatusHandler)
   

2. Require an explicit configuration change before allowing LAN access, and clearly warn users that binding to 0.0.0.0 exposes activity metadata to reachable clients.

3. Add authentication for non-loopback deployments. For example, require a sufficiently random API token in an Authorization: Bearer header and compare it using a constant-time comparison function.

4. Replace the wildcard CORS policy with either no CORS header or an allowlist containing only the intended dashboard origin. Do not treat CORS as a substitute for authentication.

5. Restrict firewall rules to the specific trusted device or private subnet instead of allowing all sources. For example:

   bash

   sudo ufw allow from TRUSTED_DEVICE_IP to any port 8765 proto tcp
   

6. Place the service behind an authenticated reverse proxy with TLS if it must be accessed outside a trusted private network. Do not expose the plaintext API directly to the internet.

7. Minimize response data by omitting exact timestamps, personalized text, and task counts unless they are required by the display.

8. Avoid returning raw exception strings in API responses, as they may disclose local paths or implementation details. Log detailed errors locally and return a generic status message to clients.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (21)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

- `SKILL.md` - This documentation

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install.sh (reported line 97)May include surrounding context.

sh

;;
    5)
        echo "Testing API..."
        curl -s http://localhost:8765/status | python3 -m json.tool || echo "❌ API not responding. Start the server first."
        ;;
    6)
        echo "Bye! 🦅"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly promotes exposing real-time agent status, task counts, and recent activity through a local HTTP endpoint and onward to a Tidbyt display, but it does not warn about sensitive operational data leakage or the trust boundary introduced by the local network. Even if intended for a home/lab setup, local network services are often reachable by other devices, and displaying recent activity can reveal workflows, presence, or potentially sensitive task context.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation instructs users to run shell commands and use environment variables, but the skill metadata declares no tool scope or allowed tools. This weakens least-privilege controls and makes it harder for operators or automated systems to understand that the skill requires code execution and local system access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is designed to expose agent status, task counts, and recent activity over an HTTP endpoint, yet the documentation does not clearly warn that this may reveal operational metadata and potentially sensitive activity patterns. Even if the payload is small, status and recent-activity fields can leak user behavior, agent workload, and timing information to anyone who can query the endpoint.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable scout-status
sudo systemctl start scout-status

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable scout-status
sudo systemctl start scout-status

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable scout-status
sudo systemctl start scout-status

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The systemctl enable instruction establishes persistence so the status server starts automatically on boot. Persistence is not inherently malicious here, but it is security-relevant because it causes a network-exposed service to remain continuously available, increasing the window for misuse or accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

Enable and start:

bash

sudo systemctl daemon-reload
sudo systemctl enable scout-status
sudo systemctl start scout-status

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Using nohup with background execution creates an unmanaged long-running process that persists after the shell exits. In this context that means the HTTP status server may continue running unintentionally, potentially exposing agent telemetry longer than the user expects and without service supervision or access controls.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Manual Background

bash

nohup python3 scripts/status_server.py > /tmp/scout-status.log 2>&1 &

Network Configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to open firewall access and test the endpoint from another machine, but does not warn that this exposes the service beyond the local host. In the context of an unauthenticated HTTP status API, this increases the chance of unintended network exposure and information leakage.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The sudo ufw allow 8765/tcp command modifies host firewall policy to permit inbound access to the status service. In context, this is security-sensitive because the exposed API appears unauthenticated and serves agent activity data, so relaxing firewall controls can materially increase attack surface and data exposure.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

2. Update firewall (if needed):

   bash

   sudo ufw allow 8765/tcp
   

3. Test from another machine:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 47)May include surrounding context.

sh

2)
        echo "Starting status API server in background..."
        cd "$SKILL_DIR"
        nohup python3 scripts/status_server.py > /tmp/scout-status.log 2>&1 &
        echo "✅ Server started. PID: $!"
        echo "   Logs: /tmp/scout-status.log"
        echo "   Stop with: kill $!"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 81)May include surrounding context.

sh

echo "Service file created at $SERVICE_FILE"
        echo
        echo "To install, run:"
        echo "  sudo cp $SERVICE_FILE /etc/systemd/system/"
        echo "  sudo systemctl daemon-reload"
        echo "  sudo systemctl enable scout-status"
        echo "  sudo systemctl start scout-status"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 82)May include surrounding context.

sh

echo "Service file created at $SERVICE_FILE"
        echo
        echo "To install, run:"
        echo "  sudo cp $SERVICE_FILE /etc/systemd/system/"
        echo "  sudo systemctl daemon-reload"
        echo "  sudo systemctl enable scout-status"
        echo "  sudo systemctl start scout-status"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 83)May include surrounding context.

sh

echo "Service file created at $SERVICE_FILE"
        echo
        echo "To install, run:"
        echo "  sudo cp $SERVICE_FILE /etc/systemd/system/"
        echo "  sudo systemctl daemon-reload"
        echo "  sudo systemctl enable scout-status"
        echo "  sudo systemctl start scout-status"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 84)May include surrounding context.

sh

echo "Service file created at $SERVICE_FILE"
        echo
        echo "To install, run:"
        echo "  sudo cp $SERVICE_FILE /etc/systemd/system/"
        echo "  sudo systemctl daemon-reload"
        echo "  sudo systemctl enable scout-status"
        echo "  sudo systemctl start scout-status"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 83)May include surrounding context.

sh

echo "To install, run:"
        echo "  sudo cp $SERVICE_FILE /etc/systemd/system/"
        echo "  sudo systemctl daemon-reload"
        echo "  sudo systemctl enable scout-status"
        echo "  sudo systemctl start scout-status"
        ;;
    4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The server binds to 0.0.0.0 and exposes detailed local user activity metadata, including recent session timing, task counts, and agent presence, to any host that can reach the port. With no authentication, no origin restriction, and permissive CORS, this creates an information disclosure issue that can leak behavioral patterns and operational status to other users or systems on the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest describes a skill that exposes OpenClaw agent status over HTTP for Tidbyt displays. This script additionally acts as an interactive installer/operations helper, including background execution and generation of a systemd service file, which is broader than the described runtime API-serving behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 68% confidence

Finding

The manifest focuses on serving JSON status data for Tidbyt displays. This installer also enumerates the machine's local IP address and instructs the user to embed it into another file, which is an auxiliary host-inspection capability not explicitly part of the skill's stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.