T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dashboard.py:518- Finding
Unauthenticated Dashboard Exposes Sensitive Workspace and Agent Data
- Content
View full analysis
- Remediation
View remediation
Security audit
AGI Farm
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent multi-agent automation purpose, but it exposes powerful local workflow controls too broadly and installs or runs code in ways users should review carefully.
Install only if you are comfortable with a skill that creates agents, writes OpenClaw workspace files, registers recurring automation, may push a public GitHub repo, and runs a dashboard with powerful controls. Before use, bind the dashboard to localhost only, add authentication, remove wildcard CORS, avoid exposing port 8080, review GitHub export contents, pin or vendor the framework integrations, and update the dashboard dependencies.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dashboard.py:728- Finding
Unauthenticated API Can Trigger Agent Jobs and Modify Persistent Workflow State
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
dashboard.py:865- Finding
Stored Cross-Site Scripting Through Unsafe Inline JSON Injection
- Content
View full analysis
window.INITIAL_DATA = {payload_json};' # Insert right before if "" in content: content = content.replace("", f"{injection}\n") ``` ### Technical Analysis The server serializes workspace data as JSON and inserts it directly into an executable ` ``` can terminate the intended script element because the HTML parser recognizes `` before JavaScript or JSON parsing occurs. Potential attacker-controlled sources include task titles and descriptions, HITL notes, inboxes, outboxes, broadcasts, project data, and knowledge entries. This makes the issue stored XSS: the payload can be persisted in a watched workspace file and executed when an operator opens or refreshes the dashboard. ### Attack Path 1. An attacker, compromised agent, or untrusted task source writes a crafted string containing `` and JavaScript into `TASKS.json`, an inbox/outbox, `broadcast.md`, or another dashboard data source. 2. The operator opens the dashboard. 3. `get_dashboard_data` includes the malicious string in `data_snapshot`. 4. `json.dumps` preserves the HTML-significant closing script sequence. 5. The server injects the serialized value into the page's ``. 6. The browser terminates the original script element and executes the injected script in the dashboard origin. 7. The payload reads dashboard da ...[truncated 654 chars]- Remediation
View remediation
... ``` 3. Before embedding JSON in HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029. For example, replace `<` with `\u003c` so `` cannot appear literally. 4. Add a restrictive Content Security Policy that disallows arbitrary inline scripts. Use script hashes or nonces if inline code is unavoidable. 5. Treat every workspace and agent-generated value as untrusted input. 6. Add regression tests using payloads containing closing script tags, HTML comments, Unicode separators, and malformed JSON. 7. Authenticate state-changing APIs so that an XSS defect does not automatically provide administrative workflow access. ]]>
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:180- Finding
Mutable Third-Party Repository Code Is Retrieved and Executed During Setup
- Content
View full analysis
-collab ]; then TMP=$(mktemp -d) git clone --depth 1 --filter=blob:none --sparse \ https://github.com/oabdelmaksoud/openclaw-skills.git "$TMP" cd "$TMP" && git sparse-checkout set -collab cp -r -collab ~/.openclaw/skills/ && rm -rf "$TMP" fi python3 ~/.openclaw/skills/-collab/build_agents.py --force 2>/dev/null || true ``` ### Technical Analysis The setup instructions clone the mutable default branch of an external Git repository, copy selected files into the user's persistent OpenClaw Skill directory, and execute `build_agents.py`. No commit SHA, signed tag, checksum, or content-signature verification is used. Consequently, the code executed during installation can differ from the version reviewed during this audit. Suppressing standard error and ignoring failure with `|| true` also reduces visibility into unexpected behavior. Although framework installation is related to the declared optional integration feature, executing mutable remote code is not the minimum-risk mechanism needed to provide that feature. ### Attack Path 1. The external repository, maintainer account, or default branch is compromised or receives an unsafe change. 2. A user selects AutoGen, CrewAI, or LangGraph integration during AGI Farm setup. 3. The setup clones the repository's current default branch. 4. The selected directory is copied into `~/.openclaw/skills/`. 5. Python executes the downloaded `build_agents.py --force` with the user's privileges. 6. The remote code can modify workspace files, install additional Skills, create persistence, access user-readable data, or run arbitrary local commands. ### Impact Assessment The retrieved Python program executes with the full privileges of the user running the setup. It can therefore ...[truncated 359 chars]- Remediation
View remediation
``` 2. Verify the expected tree or archive using a published cryptographic checksum. 3. Prefer signed release artifacts or signed Git tags and verify signatures before execution. 4. Vendor the reviewed framework integration code in this package when licensing and maintenance requirements permit. 5. Display the repository URL, exact revision, requested destination, and command to the user before running it. 6. Remove `2>/dev/null || true`; report failures and preserve diagnostic output. 7. Execute framework setup with the least privileges possible and restrict write access to the intended Skill/workspace directories. 8. Re-audit and update the pinned revision through a controlled release process rather than tracking a mutable branch. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (75)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents a broad skill whose primary purpose is provisioning and managing a full OpenClaw multi-agent system, with many backend/bootstrap capabilities. However, the provided code chunk is only a frontend dashboard asset. It contains React DOM/runtime code and dashboard UI logic, including EventSource-based live updates and fallback polling, plus rendering of agent/task/alert/budget views. While this partially matches the dashboard portion of the description, it does not substantiate the core claimed capabilities such as one-command setup, environment bootstrapping, cron/dispatcher provisioning, export, or OS-level persistence. Therefore the supplied code materially underdelivers relative to the declared purpose and represents only a narrow subcomponent of the claimed skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad system for provisioning and managing a multi-agent AI team, with multiple operational commands and infrastructure automation. In contrast, this code chunk is a compiled/minified browser-side asset focused on rendering dashboard/chart components: legends, tooltips, layout calculations, responsive sizing, animation, and Redux-like state slices for chart layout and legend state. A dashboard is mentioned in the description, but this chunk only reflects generic UI/chart plumbing and does not substantiate the main claimed capabilities such as setup, rebuild, export, dispatch, communications, cron jobs, or agent orchestration. Therefore, the supplied code does not accurately represent the declared overall purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad system bootstrapper with operational automation and deployment/export features. The provided code chunk is instead a minified/compiled client-side dashboard bundle centered on rendering charts and handling UI interactions. It includes React/Recharts components for pie/line/bar charts, axes, labels, tooltips, event handling, and some domain-specific dashboard formatting helpers for statuses, risks, due dates, and markdown export text. Those behaviors align only with the 'dashboard' portion of the description, and even there the code shown does not demonstrate SSE/file-watcher/live push plumbing—only frontend rendering logic. Because the primary claimed capabilities (setup wizard, bootstrapping infrastructure, dispatch, cron, export bundle, LaunchAgent) are absent from this code chunk, the description does not accurately represent what this supplied code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents the skill primarily as a comprehensive setup and management tool for building a multi-agent AI team, with many capabilities spanning provisioning, orchestration, exporting, and dashboarding. The actual code chunk is much narrower: it is only a frontend React hook supporting live dashboard updates via SSE with polling fallback and reconnection behavior. While the description does mention a React + SSE live ops dashboard, this code covers only that supporting dashboard behavior and none of the core claimed setup/bootstrap functionality. Therefore, the supplied code chunk does not accurately represent the broad declared purpose and is materially narrower in behavior than described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a broad interactive setup/bootstrapping skill whose primary purpose is to create and configure a full multi-agent AI team environment. The supplied code chunk does not implement that primary purpose. Instead, it implements only the dashboard portion: a local HTTP server with SSE live updates, filesystem watching, data aggregation from workspace JSON/Markdown files, and UI-serving behavior. Additionally, it includes mutable control actions not mentioned in the description for this chunk, such as triggering cron runs, toggling cron job enabled state by rewriting ~/.openclaw/cron/jobs.json, and updating task/HITL statuses in TASKS.json. While a dashboard is mentioned in the declared purpose, this code is materially narrower than the claimed setup wizard and also includes operational control capabilities that are not clearly declared. Therefore this chunk does not accurately match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The supplied code only performs local template rendering and file generation from team.json into a workspace. It does support part of the declared setup story: creating agent persona/docs files, shared comms folders/files, infrastructure documents, and a portable bundle. However, the declared description claims a much broader and more sophisticated skill: an interactive setup wizard, operational dashboard, dispatcher logic, cron jobs, LaunchAgent persistence, and several named commands. None of those capabilities appear in this code chunk. The code’s primary purpose is narrower: static scaffolding generation. Therefore the description materially overstates what the provided code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents the skill as a broad interactive setup and management wizard for creating a complete multi-agent team environment. The supplied code, however, is only the auto-dispatch portion of that system. It does not perform setup, provisioning, dashboard creation, export, rebuild, or status functions. Instead, it operates on an existing workspace by reading TASKS.json/comms files, deciding which agents to trigger, notifying the orchestrator about HITL tasks, applying cooldown/backoff/dependency logic, and persisting dispatcher state. While auto-dispatch is mentioned in the description, this chunk alone materially under-delivers relative to the declared primary purpose and represents a different operational behavior than an interactive bootstrap wizard.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code chunk only implements cron registration for an existing OpenClaw team definition. It reads a team JSON file, derives a timezone, checks existing cron names, and invokes
openclaw cron addto create several scheduled jobs. This is at best one small supporting part of the declared system ('cron jobs'), but it does not match the declared primary purpose of a comprehensive interactive setup wizard that bootstraps an entire multi-agent AI team with dashboards, dispatcher, bundle export, and command interface. Therefore the description materially overstates and misrepresents what this code chunk actually does.- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The framework installation step clones external code from GitHub, copies it into the skills directory, and then executes
build_agents.pyfrom that fetched content. This is a supply-chain risk: a compromised repository, branch, or transient network attack could lead to arbitrary code execution with the user's privileges.- Content
git clone --depth 1 --filter=blob:none --sparse
https://github.com/oabdelmaksoud/openclaw-skills.git "$TMP" cd "$TMP" && git sparse-checkout set -collab cp -r -collab ~/.openclaw/skills/ && rm -rf "$TMP" fi python3 ~/.openclaw/skills/-collab/build_agents.py --force 2>/dev/null || truetext
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # Status launchctl list | grep coopercorp curl -s http://localhost:8080/api/data | python3 -m json.tool | head -5 # Restart launchctl stop ai.coopercorp.dashboard
Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
brace-expansion 1.1.12 is affected by multiple DoS issues involving pathological expansion inputs that can hang or exhaust memory. Because this library is widely used in globbing and pattern parsing, a real vulnerability exists if any tooling path accepts attacker-controlled glob-like strings, even though in this project it is only a transitive dev dependency.
- Content
Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
browserslist 4.28.1 is directly present in the toolchain and the advisories describe crash/prototype write conditions and memory growth from untrusted stats or query results. This is a real vulnerable dependency, but the exploitability in this React dashboard lockfile is mostly constrained to developer/build contexts rather than the shipped browser app.
- Content
Known Vulnerable Dependency: flatted==3.3.3 — 2 advisory(ies): CVE-2026-32141 (flatted vulnerable to unbounded recursion DoS in parse() revive phase); CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
flatted 3.3.3 has advisories for unbounded recursion DoS and prototype pollution during parse(). This is a real vulnerable dependency in the lockfile; while it is dev-only via caching/tooling paths, prototype pollution and parser abuse can still affect local automation or CI if untrusted serialized input is consumed.
- Content
Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
js-yaml 4.1.1 is affected by multiple CPU exhaustion issues from crafted YAML structures. This is a true vulnerable dependency and, even though dev-only, YAML parsers are commonly exercised in lint/config workflows where attacker-supplied config or content in a repository could trigger denial of service in CI or local tooling.
- Content
Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
nanoid 3.3.11 is reported vulnerable to infinite-loop and integer overflow edge cases in certain generator configurations. This appears to be a real dependency issue, but practical risk in this lockfile is limited because exploitation generally depends on specific API misuse with attacker-influenced size values and it is only transitively present through tooling.
- Content
Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
picomatch 4.0.3 is affected by method-injection and ReDoS issues in glob matching. This is a real vulnerable dependency used in the Vite/globbing toolchain, and the danger increases if attacker-controlled file patterns or project contents are processed by the dashboard's development and rebuild workflows.
- Content
Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
postcss 8.5.6 has multiple advisories including arbitrary file read and XSS-related issues tied to attacker-controlled source maps or CSS output. This is a real vulnerable dependency in the frontend toolchain, and the skill context makes it more concerning because it ships a React dashboard and likely processes frontend assets during active dev-server use.
- Content
Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
vite 7.3.1 is flagged for multiple arbitrary file read and path traversal issues in the development server. This is a true vulnerability and especially relevant here because the skill explicitly provides a React + SSE live ops dashboard, making dev-server usage central to the feature set; if exposed beyond localhost, an attacker could read files outside the intended project scope.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </head> <body> <!-- ── Header ─────────────────────────────────────────────── --> <div id="header"> <div class="brand">Cooper<span>Corp</span> AGI</div> <div class="live-indicator">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <div class="nav-tab" data-tab="broadcast">Broadcast</div> </nav> <!-- ── Main ───────────────────────────────────────────────── --> <main id="main"> <!-- OVERVIEW -->
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- TASKS --> <div class="tab-panel" id="tab-tasks"> <div class="filter-bar" id="task-filter-bar"> <button class="filter-btn active" data-filter="all">All</button>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises a one-command GitHub export/push workflow but does not clearly warn users that workspace contents, generated agent files, prompts, task data, and possibly sensitive project material may be transmitted to an external third-party service. In a tool designed to bootstrap and manage multi-agent workspaces, that omission materially increases the risk of accidental data exfiltration by users who may assume export is local or fully safe by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup flow describes automated cron registration, framework installation, GitHub push, workspace commits, and persistent LaunchAgent/dashboard behavior without a prominent warning that these actions modify the local system, create persistence, install software, and may send data off-host. In an interactive bootstrapper, users may run setup expecting configuration only, making the missing safety disclosure a meaningful security and trust issue.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs use of shell, filesystem writes, network access, Git/GitHub operations, and environment-dependent commands, yet it declares no explicit tool scope or permissions. That makes the skill over-privileged by omission and prevents users or a runtime from constraining high-risk actions such as agent creation, cron registration, repo publishing, and local service startup.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Store as `FRAMEWORKS` list. `all` → `["autogen", "crewai", "langgraph"]`. ### Step 5 — GitHub > "Create a GitHub repo for the bundle? yes / no" Store as `CREATE_GITHUB`.
Static analysis
No suspicious patterns detected.