Security audit
Security checks for vulnerabilities and agentic risk
The skill is a real dashboard tool, but its public-sharing workflow exposes admin actions, local memory content, weak default credentials, and recurring status details more broadly than users are likely to expect.
Review carefully before installing or exposing this skill. Use it only in a trusted local environment unless you first set strong ASSET_DRAWER_PASS and Flask secret values, restrict or authenticate all mutating and memo endpoints, avoid publishing OpenClaw memory contents, and confirm exactly where status-push clients send state details and join keys.
office-agent-push.py:21Automatic transmission of local OpenClaw activity to a fixed third-party server
backend/app.py:873Unauthenticated state modification and agent administration endpoints
backend/app.py:1223Unauthenticated OpenClaw memory disclosure with unsafe HTML rendering
backend/app.py:83Recommended public exposure retains predictable default authentication secrets
The script reads LOCAL_STATUS_URL from an environment variable and performs a GET request to it, optionally attaching an Authorization bearer token from OFFICE_LOCAL_STATUS_TOKEN. This creates an SSRF-style sink and credential exfiltration path: an attacker who can influence the environment can redirect the request to an attacker-controlled endpoint and capture the token or force connections to unintended internal services.
headers = {}
if LOCAL_STATUS_TOKEN:
headers["Authorization"] = f"Bearer {LOCAL_STATUS_TOKEN}"
r = requests.get(LOCAL_STATUS_URL, headers=headers, timeout=5)
if r.status_code == 200:
data = r.json()
state = normalize_state(data.get("state", "idle"))
The script allows LOCAL_STATUS_URL to be fully controlled by an environment variable and then performs an authenticated requests.get to that URL, optionally attaching OFFICE_LOCAL_STATUS_TOKEN in the Authorization header. This creates an SSRF-style exfiltration path where a malicious skill/operator can redirect the request to an attacker-controlled endpoint and capture the bearer token or force connections to unintended internal services.
headers = {}
if LOCAL_STATUS_TOKEN:
headers["Authorization"] = f"Bearer {LOCAL_STATUS_TOKEN}"
r = requests.get(LOCAL_STATUS_URL, headers=headers, timeout=5)
if r.status_code == 200:
data = r.json()
state = normalize_state(data.get("state", "idle"))
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
The skill markets itself as one-click deployment, but many steps involve manual shell execution, configuration changes, state mutation, optional secret setup, and operational exposure decisions. Overstating simplicity can pressure agents to execute a broad sequence without adequate user confirmation, which increases the chance of unsafe automated actions on the host.
Referenced artifact was not completely inspected
python3 -m pip install -r backend/requirements.txt
Referenced artifact was not completely inspected
python3 -m pip install -r backend/requirements.txt
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.install_untrusted_source