Security audit

FlowBoard

Security checks across malware telemetry and agentic risk

Overview

FlowBoard is a disclosed local project dashboard and OpenClaw hook with meaningful local control, but its authority is purpose-aligned, scoped, and user-directed.

Install only if you are comfortable running a local dashboard that agents and local processes can use to manage FlowBoard projects, tasks, specs, canvas notes, and related AGENTS.md snippets. Keep it bound to localhost unless Telegram/JWT auth is fully configured, avoid enabling the LAN bypass or self-update unless you understand the trust tradeoff, and prefer environment variables over DB storage for tokens.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dashboard/server.js:2474
Evidence: // /api/info for the new version). FLOWBOARD_UPDATE_DRY=1 skips the spawn (tests).

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dashboard/specify-worker-openclaw.js:19
Evidence: // Static-scanner note (T-417-18): execFile (NO shell) with a fixed binary and a

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.mjs:95
Evidence: const r = spawnSync(cmd, args, { stdio: 'inherit', ...opts });

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dashboard/github.js:9
Evidence: const ENV_TOKEN = process.env.FLOWBOARD_GITHUB_TOKEN || process.env.GITHUB_TOKEN || '';

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dashboard/server.js:14
Evidence: const PORT = parseInt(process.env.FLOWBOARD_PORT, 10) || 18790;