Command Center

• Outcome: Review
• Latest audit: Jun 24, 2026 · 8:33 AM UTC
• Version: 1.0.0

Overview

This appears to be a real OpenClaw dashboard, but it exposes sensitive agent data and write/control APIs with defaults that are less constrained than the documentation implies.

Install only if you are comfortable running a local dashboard that can read sensitive OpenClaw session/workspace data and change some workflow state. Before use, bind it explicitly to localhost or a protected interface, set a real auth mode such as token/Tailscale/Cloudflare with a narrow allowlist, avoid public tunnels unless separately protected, and treat operator/transcript-derived data as private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no permissions even though it starts a Node server and, by the analyzer's account, uses environment access, networking, and shell capabilities. That creates a transparency and consent problem: operators may install or run it without understanding that it can expose data over HTTP and invoke system-level actions. In a dashboard skill that aggregates session and system state, undeclared capabilities materially increase risk because the data handled is sensitive.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The published description frames the skill as a passive monitoring dashboard, but the analyzed behavior includes active control and mutation features: job control, settings persistence, transcript parsing, external issue updates, and operational scripts. That mismatch is dangerous because users may grant trust appropriate for read-only observability while the skill can alter local state, control jobs, and interact with external services. In this context, the hidden write/control surface substantially raises the chance of misuse or unintended damage.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The jobs API exposes multiple state-changing endpoints such as run, pause, resume, skip, kill, and cache clear through the dashboard server. This exceeds a read-only monitoring role and creates a control plane over local job execution; if authentication is weak or disabled, a remote user can directly disrupt or trigger automation.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The dashboard can modify Cerebro topic files via the topic status update endpoint, writing directly into files under the workspace. For a component presented as a monitoring/viewing dashboard, this is an integrity risk because an authenticated or exposed client can alter operational knowledge and workflow state.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The code persists operator and privacy configuration data to disk, meaning the dashboard is not purely observational and can change local state. This becomes dangerous when combined with permissive authentication, because a caller can alter operator metadata or privacy behavior and affect future UI behavior and data handling.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The dashboard parses session transcripts to infer and store operator identities from Slack, Telegram, and Discord metadata, creating a local index of user identities and activity. This expands the sensitivity of the system significantly, because compromise of the dashboard exposes cross-channel personal identifiers and behavioral data not strictly required for basic monitoring.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This dashboard is not purely read-only: it exposes state-changing administrative actions such as health checks, gateway status requests, stale-session pruning, topic status updates, and privacy-setting persistence via API calls. In an agent skill context, mixing monitoring with operational controls increases the attack surface because any missing authentication, CSRF protection, or authorization on those endpoints could let a viewer trigger backend changes.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script executes package-manager install commands derived from a JSON configuration at runtime, giving the skill host the ability to modify the system by installing software. For a monitoring dashboard skill, this exceeds the minimally necessary capability and increases risk because a tampered dependency file or package entry could trigger unexpected privileged changes, network access, or execution of installer hooks.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This module does more than observe dashboard state: it actively changes external Linear issue status and posts comments based on inferred session state. That is a real capability expansion because transcript-derived references can trigger external workflow mutations without a clear, explicit approval boundary, which increases the risk of unintended or unauthorized changes to project tracking systems.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code parses full session transcripts to mine issue identifiers, which exposes a broader set of potentially sensitive content than is necessary for a monitoring dashboard. Even though only IDs are extracted here, reading full transcripts creates unnecessary access to session content and forms the basis for automated external actions tied to that content.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code updates package metadata and documentation, creates a git commit and annotated tag, and pushes both commit and tag to the remote repository. Those source-control write operations are not justified by a manifest focused on real-time observability and viewing agents in one place.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script can optionally publish the locally hosted dashboard to the public internet via a Cloudflare tunnel with no authentication, access control, or user confirmation visible in this script. For a monitoring dashboard that may expose agent session data, usage metrics, and system vitals, external exposure materially increases the risk of unauthorized access and information disclosure.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The /api/action endpoint executes a caller-supplied action and is not merely a passive monitoring feature. In a dashboard context this expands the attack surface from read-only observability to operational control, so any auth weakness, CSRF exposure, or accidental network exposure could let an attacker trigger OpenClaw actions and affect running systems.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The /api/operators and /api/privacy handlers accept client JSON and persist changes to disk, which makes the skill materially state-changing despite its monitoring-oriented description. This can be abused to tamper with operator metadata or privacy controls, potentially hiding activity, corrupting records, or misleading users about system state if the server is reachable by unauthorized or cross-site requests.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The Cerebro topic status endpoint changes workflow state by updating topic status values on disk or in backing storage, which goes beyond passive status viewing. In a command dashboard this can let a user reclassify or suppress operational items, affecting triage and downstream automation if access controls fail or are misconfigured.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This handler exposes state-changing job-control endpoints such as run, pause, resume, skip, kill, and cache clear from a dashboard component described as monitoring/view-oriented. If these routes are reachable without strong authorization, an attacker or over-privileged user could disrupt scheduled work, force execution, terminate jobs, or alter operational state, turning an observability surface into a control plane.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The code provides direct operational capabilities to execute and terminate jobs that are not clearly justified by the stated dashboard purpose of viewing sessions, tracking usage, and system vitals. This mismatch increases risk because operators may deploy or trust the component as read-only while it actually permits impactful actions against backend job processing.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code performs periodic background scanning of session transcript files and extracts identity data such as Slack, Telegram, and Discord usernames/IDs, then persists that information to disk. For a monitoring dashboard, this is a privacy-sensitive expansion of scope because it repurposes message content into a cross-session identity database without any visible consent, minimization, or access controls in this module.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This logic explicitly parses transcript text for Slack, Telegram, and Discord identity markers and stores those identifiers in operators.json, creating a persistent cross-platform identity map from conversational content. That is dangerous because it aggregates personal identifiers beyond the dashboard's stated usage-tracking role and increases privacy, insider misuse, and data-exposure risk if the file is accessed or leaked.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The dashboard code reads full session transcripts and extracts user task summaries, labels, message counts, and other content-derived metadata. For a monitoring dashboard advertised around session monitoring, usage, costs, and vitals, this expands access into potentially sensitive prompt and conversation content, creating an unnecessary data exposure path if shown to unauthorized viewers or logged elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The utility exposes a generic shell execution primitive via `runCmd(cmd, options)`, directly passing arbitrary strings into `child_process.exec`. In a mission-control dashboard context, this creates a dangerous capability expansion: if any caller forwards user-controlled or remotely influenced input into this helper, it can lead to OS command injection or arbitrary command execution with the dashboard's privileges.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README explicitly advertises visibility into sessions, costs, operators, memory files, and scheduled tasks, which are sensitive operational artifacts, but it does not pair that with a clear privacy warning about what data may be exposed to anyone with dashboard access. In a monitoring/dashboard skill, this omission is meaningful because users may deploy it assuming 'read-only' and 'localhost default' are sufficient without recognizing the sensitivity of the displayed workspace and agent data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quick-start instructions tell users to install and run the dashboard immediately, but do not warn that doing so may expose sensitive local workspace, session, memory, and operational data to any local user or to others if the binding/auth configuration is later changed. For a tool whose core purpose is aggregating sensitive agent state, launching without an upfront warning increases the chance of unsafe deployment assumptions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation advertises a local dashboard and API endpoints but does not prominently warn that the service exposes potentially sensitive session, transcript, cost, and system telemetry data over a web interface. Because it also mentions remote/public deployment modes, users may expose the dashboard beyond localhost without understanding the confidentiality implications. In a monitoring tool aggregating cross-session data, missing security warnings meaningfully increases exposure risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The 'Clean Stale Sessions' quick action invokes a backend cleanup operation directly with no user warning, confirmation step, or friction. This makes accidental destructive actions easy, and if an attacker can induce clicks or exploit weak endpoint protections, they can trigger unwanted cleanup affecting session availability or forensic state.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib/server.js:565

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/install-system-deps.sh:50

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/linear-sync.js:495

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/llm-usage.js:19

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/openclaw.js:46

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/iostat-leak.test.js:16

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/server.test.js:14