Security audit

Mission Control

Security checks across malware telemetry and agentic risk

Overview

Mission Control is a real task dashboard, but it also handles broad GitHub credentials, public webhook exposure, persistent agent wakeups, cron control, and an unsafe optional CORS proxy in ways users should review carefully.

Install only if you want a GitHub-backed, webhook-driven automation system, not just a local kanban board. Use a dedicated least-privilege GitHub token, avoid shared browser profiles, configure a real webhook secret, restrict dashboard and repository access, avoid exposing the CORS proxy publicly, and review every setup step before allowing it to push code, enable Funnel, or wake an agent automatically.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (52)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill documentation describes capabilities that read environment/config state and write files under the user's home directory and workspace, but it does not declare corresponding permissions. Undeclared sensitive capabilities weaken user consent and policy enforcement because setup actions like writing ~/.clawdbot config and installing webhook transforms expand the agent's effective access beyond what the manifest advertises.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared purpose is task management, but the described/observed behavior includes additional operational capabilities such as running a network proxy, performing automatic git add/commit/push, and exposing services via Tailscale Funnel/GitHub webhooks. That mismatch is dangerous because users may authorize a seemingly simple kanban skill without realizing it can expose local services, alter repositories, and create externally reachable automation paths.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The bundled onboarding task content instructs users to enable GitHub Pages, create a classic repo-scoped GitHub token, expose a local service with Tailscale Funnel, and configure GitHub webhooks. Those actions materially expand the skill from a local task board into credential handling and internet-exposed integration, which increases attack surface and can mislead users into performing risky setup that is not obviously required for kanban functionality.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The onboarding guidance includes generating credentials, pasting a GitHub token into a dashboard, opening network exposure via Funnel, and creating a webhook token, all embedded inside routine setup tasks. Embedding these risky operational steps in an innocuous task-board skill can socially engineer users into weakening their security posture without understanding the consequences.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The example configuration exposes integration points for Slack and GitHub secret material that are not necessary for a basic kanban/task-board skill description. Even though the values shown are placeholders and file paths, documenting these capabilities encourages deployment with broader privileges and expands the attack surface of the skill beyond task management into external messaging and repository access.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill materially exceeds a Kanban dashboard by invoking an external gateway to list, run, update, disable, and create cron jobs. That gives the UI operational control over automated processes outside the declared task-management scope, which increases the attack surface and can lead to unauthorized job execution or configuration changes if a user trusts the dashboard with credentials.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The UI instructs users to create a classic GitHub Personal Access Token with broad repo scope, which grants full private-repository read/write access well beyond basic board interaction. If the page is compromised or misused, that token can be abused to read, modify, or destroy repository contents and potentially expose sensitive code or data.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The People view calls the collaborators API and exposes repository membership and role information, adding team-intelligence functionality not described in the skill metadata. This can disclose organizational structure and privilege distribution to any authenticated user of the dashboard, which may aid reconnaissance or targeted abuse.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The page tells users the GitHub token is only stored locally and only sent to GitHub, but the implementation persists credentials under multiple localStorage keys and also supports a separate external gateway token flow. Misleading security claims can cause users to provide highly privileged credentials without understanding persistence and broader trust boundaries.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The transform does more than passive task management: it posts to Slack and triggers an external agent hook that can begin autonomous work based on repository changes. In this skill context, that broadens the trust boundary from a dashboard/CLI tool into webhook-driven automation, increasing the chance of unintended actions if repository content or webhook events are manipulated.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code is configured to consume Slack and GitHub credentials from environment variables and user config locations even though the skill is described primarily as task-board management. That mismatch can lead users to grant or expose higher-privilege secrets than expected, expanding the blast radius if the transform is abused or misconfigured.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The transform fetches repository contents from GitHub over the network and parses task data from the latest commit, which is a meaningful capability expansion beyond a local dashboard/CLI. In context, this matters because repository-controlled content directly influences later notifications and agent work orders, making remote content part of the execution flow.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: HMAC verification is effectively fail-open: if the secret file is absent, the function returns true and accepts the webhook as valid. This allows unauthenticated requests to drive the transform, potentially causing Slack notifications, GitHub-backed processing, and agent wakeups from attacker-supplied webhook payloads.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation describes behavior that exceeds the stated mission-control dashboard scope: webhook-triggered agent wakeups, autonomous task execution, repository writes, and external integrations. In a skill for AI assistants, hidden or under-declared execution and network capabilities materially increase the risk of unexpected actions, privilege misuse, and user misunderstanding about what a simple task board can cause.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The prerequisites materially expand a stated local kanban/task-management skill into infrastructure that accepts GitHub webhooks, exposes a local service through Tailscale Funnel, and performs GitHub authentication and repository operations. That broadening of scope increases attack surface and privileges far beyond what users would reasonably expect from the manifest, creating a dangerous mismatch that can lead to unintended network exposure and repository access.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The document instructs users to expose a local Clawdbot port to the internet via Tailscale Funnel, even though the skill is described as a task dashboard. Publishing a local service creates a direct remote attack path to software running on the user's machine, and if webhook handling or the local app is weak, this can enable unauthorized access or compromise.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The instructions require GitHub CLI authentication and encourage repository creation/API use without clearly justifying why a kanban dashboard needs those privileges. This can cause users to grant repository and account access to a tool whose advertised purpose does not imply such permissions, increasing risk of token misuse, accidental repo modification, or data exfiltration.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation expands the skill from a kanban/task dashboard into real-time management of OpenClaw cron jobs, which is a materially different and more privileged capability than the manifest describes. This mismatch increases the chance that users grant network access and operational trust to a skill whose true behavior is broader than expected, enabling unintended control over scheduled automation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The guide instructs users to set up remote gateway access and a permissive CORS proxy, which meaningfully extends the attack surface beyond a local task dashboard. Exposing a management gateway over tunnels and cross-origin access can allow unauthorized interaction, token theft abuse, or broader remote control if the gateway or browser environment is compromised.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements a generic HTTP proxy with permissive CORS headers and binds it to 0.0.0.0, making it externally reachable if the host is exposed. That capability is unrelated to a kanban/task-management skill and can be abused as a cross-origin access bridge to the local service on port 18789, expanding attack surface and enabling unintended network access.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The server sets Access-Control-Allow-Origin to '*' and accepts broad methods and headers while forwarding requests to a local backend. In skill context, this is especially dangerous because an externally reachable, CORS-enabled proxy is unjustified by the declared mission-control purpose and can let arbitrary web pages interact with the proxied service from a victim's browser.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script silently escalates a local task-update helper into a repository write-and-publish tool by automatically committing and pushing `data/tasks.json` to GitHub after any change. In an agent context, this can exfiltrate task content, publish unintended modifications, and create an integrity risk because a simple status/comment action causes persistent remote side effects without explicit approval.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Automatic `git push` is unnecessary for the stated purpose of updating a kanban task board and grants network/publication capability beyond the helper's expected scope. In an AI-assistant skill, this is especially dangerous because routine task operations may be triggered automatically, causing unauthorized publication of repository changes or leakage of sensitive task metadata to the remote origin.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation phrase "Set up Mission Control for my workspace" is broad enough to overlap with ordinary setup/help requests, which increases the chance of accidental activation. In this skill, activation can trigger repository changes, local file copies, webhook installation, and deployment steps, so an unintended invocation could cause real side effects without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README states that the agent "handles everything automatically" and then lists actions that modify local files, install transforms, configure GitHub webhooks, and deploy to GitHub Pages, but it does not present a strong upfront warning or confirmation boundary before those operations. This creates a risk of users authorizing impactful changes without understanding scope, especially because the skill is designed to automate execution from natural-language requests.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.install_untrusted_source (+1 more)

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: assets/transforms/github-mission-control.mjs:26

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: assets/data/tasks.json:12

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: assets/examples/mission-control.json:3

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: assets/transforms/github-mission-control.mjs:166