Openclaw Control Center

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.0

Overview

This looks like a legitimate OpenClaw dashboard skill, but it can collect sensitive operational details into a persistent local HTML file and requests broader authority than a status dashboard needs.

Install only if you are comfortable with a local dashboard that may reveal OpenClaw session, cron, plugin, gateway, and security metadata. Prefer the simple view, avoid sharing or syncing the generated HTML file, review professional-mode output before displaying it publicly, and do not use the optional remote npm deployment unless you have reviewed and pinned the repository and dependencies. The requested `exec` capability deserves particular scrutiny.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/deployment.md:23

Finding

Unpinned Remote Repository and npm Script Execution

Content

View full analysis

Vulnerability Details

File Location: references/deployment.md:23-42
Additional Location: README.md:62-69
Vulnerability Type: Mutable remote payload retrieval and insecure dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Clone the project
git clone https://github.com/TianyiDataScience/openclaw-control-center.git
cd openclaw-control-center

# Install dependencies
npm install

# Configure the environment
cp .env.example .env

# Build and execute project scripts
npm run build
npm run test
npm run smoke:ui

# Start the application
npm run dev:ui

Technical Analysis

The deployment procedure clones the default branch of an external repository without pinning a reviewed commit, tag, or content digest. Its effective payload can therefore change after this Skill has been audited.

Running npm install may execute lifecycle scripts from the project and its transitive dependencies. The subsequent npm run commands explicitly execute scripts defined by the remotely retrieved project. Neither the repository contents nor installed packages are authenticated against an expected checksum or signature.

This combines remote payload retrieval with an unsafe software supply-chain process. A compromised upstream repository, malicious maintainer update, dependency takeover, dependency confusion event, or compromised npm package could introduce executable code without modifying this audited Skill package.

The AI-assisted deployment workflow increases the exposure by recommending automated environment detection, dependency installation, building, and startup without an intervening source review or explicit approval for each execution stage.

Attack Path

1. An attacker compromises the referenced GitHub repository, its default branch, or a dependency resolved during installation.
2. The attacker inserts a malicious npm lifecycle script, project script, or trans ...[truncated 1038 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a reviewed immutable commit hash rather than cloning and executing the default branch.
2. Publish and verify a SHA-256 digest or signed release artifact before execution.
3. Commit a reviewed lockfile and replace npm install with npm ci.
4. Initially install with lifecycle scripts disabled, such as npm ci --ignore-scripts, and separately review every required script before allowing it.
5. Audit direct and transitive dependencies, including package names, resolved registries, integrity hashes, and maintainer history.
6. Require explicit user approval before cloning, installing dependencies, running each project script, or starting a service.
7. Run the deployed application in a restricted container or low-privilege account without access to unrelated user files or OpenClaw credentials.
8. Document the exact reviewed repository owner, release tag, commit hash, Node.js version, npm version, and lockfile digest.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:34

Finding

Persistent Plaintext Dashboard Exposes Sensitive Operational Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-41,58-78
Additional Locations: references/dashboard-rules.md:38-49,107-115; references/pro-mode.md:85-96
Vulnerability Type: Excessive sensitive-data collection and persistent plaintext storage
Risk Level: Medium

Vulnerable Code Snippet:

text

session_status()
sessions_list()
cron(action="list")
gateway(action="config.get")

Generated output:
~/.qclaw/workspace/control-center.html

The professional dashboard is instructed to include:

text

Session Key
Channel
Transcript Path
Cron Job ID
Cron Payload
Plugin Path
Security Configuration
REST API Endpoints
WebSocket Address

Technical Analysis

The Skill enumerates all sessions, cron jobs, Gateway configuration, plugins, and channels rather than collecting only the minimum information required for a health dashboard. Professional mode can expose session identifiers, task payloads, transcript locations, plugin filesystem paths, API topology, and the current security posture.

These details are then rendered into ~/.qclaw/workspace/control-center.html, creating a persistent browser-readable plaintext artifact. The instructions do not require restrictive file permissions, redaction, expiration, secure deletion, or explicit consent before collecting and retaining the detailed fields.

The audit found no mechanism that transmits this information to an external server. The risk instead arises from unnecessary aggregation and local disclosure. A single dashboard file becomes a high-value reconnaissance source for another local user, process, browser extension, backup service, synchronization tool, or accidental recipient.

Attack Path

1. A user invokes the control-center Skill, particularly professional mode.
2. The Skill queries all sessions, cron jobs, Gateway configuration, plugins, and channels.
3. Sensitive operational metadata is inserted into the g ...[truncated 1059 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply data minimization and collect only aggregate health counts in the default mode.
2. Require explicit, informed user approval before querying or rendering professional-mode details.
3. Redact session keys, cron payloads, transcript paths, plugin paths, and other unnecessary identifiers.
4. Display shortened identifiers only when operationally necessary.
5. Avoid writing sensitive details to persistent HTML; prefer an ephemeral page or in-memory rendering.
6. If a file must be created, apply owner-only filesystem permissions and prevent access by other local accounts.
7. Add expiration and secure cleanup behavior for generated dashboards.
8. Warn users not to share, synchronize, email, or upload professional-mode dashboard files.
9. Escape all collected values before HTML insertion to prevent stored markup or script injection if any upstream field contains attacker-controlled content.
10. Separate the basic status view from privileged diagnostic collection so routine invocations do not enumerate unrelated sessions or configuration.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: metadata.json:13

Finding

Unnecessary Unrestricted Command-Execution Capability

Content

View full analysis

Vulnerability Details

File Location: metadata.json:13-16
Vulnerability Type: Overbroad tool permission violating least privilege
Risk Level: Low

Vulnerable Code Snippet:

json

{
  "openclaw": {
    "minVersion": "0.1.0",
    "requires": {
      "tools": [
        "session_status",
        "sessions_list",
        "cron",
        "gateway",
        "browser",
        "exec"
      ]
    }
  }
}

Technical Analysis

The Skill declares access to the general-purpose exec tool even though its primary behavior is to collect status information, write a static HTML file, and open that file in a browser. General command execution is substantially broader than the narrowly scoped file-generation and browser-opening operations required by the stated task.

Possession of the capability is not itself evidence that the Skill currently executes malicious commands. However, it increases the impact of future instruction manipulation, compromised collected content, implementation mistakes, or unsafe extensions to the Skill. This conflicts with the principle of least privilege.

Attack Path

1. The Skill is installed with its declared exec capability.
2. An attacker influences the Skill's execution context, a future instruction update, or data incorporated into an execution command.
3. The overbroad tool permission allows the affected Agent to execute commands beyond dashboard generation.
4. Commands run with the privileges of the OpenClaw process or invoking user.

This is a capability-amplification path. The reviewed files do not contain a confirmed command-injection payload or malicious command beyond opening the generated dashboard.

Impact Assessment

If the capability is abused, it could permit arbitrary local command execution within the privileges of the Agent process. Potential access includes workspace files, user-readable configuration, environment variables, and o ...[truncated 261 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the required tools if the platform can write files and open local pages through narrower APIs.
2. Use a dedicated browser-open operation restricted to the generated dashboard path.
3. Use a file-write capability restricted to ~/.qclaw/workspace/control-center.html.
4. If exec is unavoidable, require explicit approval before every invocation.
5. Enforce an allowlist containing only a fixed browser-opening command and reject user-controlled command fragments.
6. Pass the file path as a safely separated argument rather than concatenating it into a shell command.
7. Run the Skill under a low-privilege account with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

md

npm install

# 3. 配置环境
cp .env.example .env

# 4. 构建
npm run build

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/deployment.md (reported line 34)May include surrounding context.

md

npm install

# 3. 配置环境
cp .env.example .env

# 4. 构建
npm run build

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/deployment.md (reported line 135)May include surrounding context.

md

|------|---------|
| 页面空白 | 检查 Gateway 是否运行在 28789 端口 |
| 数据不更新 | 刷新页面，WebSocket 会重连 |
| 401 Unauthorized | 检查 .env 中的 token 配置 |
| 端口被占用 | 改用其他端口：`PORT=4311 npm run dev:ui` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions tell the user to ask the AI to install the skill from a local path, but they do not warn that this may cause the AI to perform filesystem operations such as copying files or modifying skill directories. In an agent environment, omission of this warning can lead users to authorize impactful local changes without understanding scope, especially because the skill manages a control center with privileged operational visibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation phrase "打开控制中心 / 控制中心 / dashboard / 系统总览 / 系统状态" is broad enough to overlap with normal user requests about viewing system information. In an agent skill context, this can cause unintended invocation of the skill and undesired actions such as opening a browser or exposing operational dashboards when the user only intended a general query.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uninstall section instructs users to delete a folder but provides no warning about destructive deletion or the need to verify the target path. If followed through an AI assistant or by an inattentive user, this could result in accidental removal of the wrong directory or loss of customized files stored under the skill folder.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README presents the skill entirely in Chinese and instructs the user to invoke it with Chinese trigger phrases such as "打开控制中心", while the deployment example explicitly uses a Chinese language parameter (lang=zh). There is no indication that other languages are supported or that the user can choose a preferred locale, which is a natural-language policy concern under the stated rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly states that the AI will automatically collect real-time data, generate an HTML dashboard, and open it in a browser, but it does not clearly warn that session details, cron payloads, plugin states, or other operational metadata may be rendered to disk and on screen. In a control-center skill, that omission increases the risk of sensitive information disclosure to local files, shoulder-surfing, screenshots, or browser history/workspace artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase “系统状态” is broad and commonly appears in ordinary monitoring or troubleshooting requests, so this skill may activate when the user did not intend to open a control center. In this skill’s context, unintended activation is more dangerous because the README says it will collect real-time data and generate/open a dashboard, which can expose sensitive operational information to the screen or filesystem.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrase “dashboard” is highly generic and likely to collide with many unrelated user requests about dashboards, reporting, or UI views. Because this skill claims to auto-collect system/session/cron/plugin data and open a browser, ambiguous activation can lead to unnecessary data exposure or unintended execution flow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very generic terms such as “控制中心”, “dashboard”, “系统总览”, and “系统状态”, which can overlap with ordinary user requests and cause the skill to activate unexpectedly. Because this skill gathers and presents operational data, accidental invocation increases the chance of exposing sensitive system information without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes collecting and displaying live operational data, but it does not prominently warn that the dashboard may expose sensitive details such as session metadata, job configuration, plugin paths, channels, and gateway settings. Users may invoke the skill expecting a harmless status page and unintentionally reveal privileged internal data on screen or in generated files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Professional mode explicitly calls for displaying full session details including Session Key, Token, channel information, job payloads, timeout, delivery settings, WebSocket addresses, plugin paths, and gateway endpoints. These fields can contain credentials, internal topology, identifiers, or actionable operational metadata that materially help an attacker or leak secrets to any local viewer.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow instructs the skill to enumerate all sessions, cron jobs, gateway configuration, plugins, and channels, then render all collected data into a local HTML dashboard and open it automatically in a browser. This broad aggregation significantly increases exposure because it centralizes sensitive runtime and configuration data in one artifact, which may be visible to shoulder-surfing, browser history, local file access, or unintended users on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest sets the skill language to "zh-CN", and the display name, tagline, and description are all written only in Chinese. This indicates a fixed locale without any visible opt-in, fallback, or documentation that the skill is intentionally restricted to a Chinese-speaking region.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is described as a visualization and monitoring dashboard, but it requests the exec tool, which enables arbitrary shell command execution far beyond the stated purpose. In a control-center context, this materially expands the attack surface: any prompt injection, UI action abuse, or hidden workflow could turn a read-oriented dashboard into a host-compromise path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document mandates fixed Chinese copy such as the hint format 💡 提示：[术语] 就是 [通俗解释], which prescribes a specific language for user-facing output. Because the file does not offer user opt-in or document a justified locale-specific constraint, this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly instructs users to let an AI automatically clone a repository, install dependencies, build, and start software on the local system. That creates a supply-chain and arbitrary code execution risk because repository contents and install/build scripts may run without human review, and the skill context encourages operational deployment rather than isolated experimentation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document exposes unusually detailed internal configuration for a control-center skill, including runtime, build identifier, network endpoints, authentication mode, plugin inventory, retention settings, and workflow architecture. Even though the endpoints are loopback-bound, this materially lowers the barrier for local attackers, malicious plugins, or insiders by providing a high-quality reconnaissance map of the system and its defensive posture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file discloses a 365-day log retention period and references complete transcript paths without any privacy warning, minimization rationale, or access-control guidance. In a system handling sessions and AI transcripts, this increases privacy and data-exposure risk by normalizing long-term storage of potentially sensitive user content and revealing where such records may reside.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document claims a read-only, no-mutation safety posture while also advertising a mutation-capable cron management API with POST support. This kind of contradictory security messaging can cause operators or downstream agents to make unsafe assumptions, increasing the chance of unauthorized task creation or policy bypass if access controls are weaker than implied.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and core instruction are written as mandatory Chinese style guidance, and L03 states the file must be followed before every generation. This effectively forces a specific language/locale behavior without indicating that the user can choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The writing-style section requires outputs to use colloquial Chinese phrasing such as '说人话' and prescribes exact stylistic behavior as a blanket rule. Because no alternative language option or user preference mechanism is described here, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese, including feature descriptions and technical notes. Under the language/locale policy, forcing a specific language without user opt-in or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All user-facing instructions and example prompts are presented only in Chinese, which can constitute a language policy issue when no user opt-in or locale justification is provided. The file does not state that the skill is intended exclusively for a Chinese-speaking audience or offer alternative language support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.