ClawHub
Back to skill

Security audit

Openclaw Agent Runner Site

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed static-site helper for an OpenClaw agent runner, with some capability overstatement but no hidden or destructive behavior found.

Before installing, understand that this is mainly a helper for creating a browser-based runner page. Avoid storing high-value API keys in localStorage unless you accept that browser storage risk, and verify the exact OpenClaw Gateway endpoints before enabling real run or streaming calls.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a mismatch because the declared purpose says the generated page can run the agent and stream output, but the actual code explicitly does not implement backend calls, agent execution, or streaming. Instead, it only generates a static UI scaffold with a non-functional stub. There are no hidden extra capabilities, but the primary behavior is materially less capable than described.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The file says the skill activates when the user wants to make a web page and includes short phrases like 'agent runner' and 'runner site', then further broadens activation to anything 'cocok dengan deskripsi di atas.' This lacks clear boundaries or exclusion examples, so ordinary requests about a generic runner UI could unintentionally match.

Static analysis

No suspicious patterns detected.