Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it records complete browser API traffic in a way that can expose secrets and business data without enough safeguards.
Install only if you are authorized to monitor the target application and can keep the captured logs private. Avoid production or sensitive accounts where possible, do not share generated logs with an AI system or commit them to source control until Authorization, Cookie, tokens, personal data, and confidential payloads are removed. Prefer verified installation steps over the documented curl-to-shell command.
README.md:55Unverified Remote Installer Is Piped Directly into a Shell
scripts/network-monitor.js:40Unrestricted Capture and Export of Sensitive Browser Traffic
scripts/network-monitor.js:9Captured Network Logs Are Exposed Through Page-Global Objects
package.json:20Unbounded and Unlocked Third-Party Dependency Versions
The README instructs users to execute a remote installer directly via curl piped to sh, which grants immediate shell execution to whatever content the remote server returns at that moment. If the distribution server, DNS, TLS termination, or hosted script is compromised, users can suffer full arbitrary code execution on their machine.
# Install via official installer
curl -sSL https://install.openclaw.ai | sh
# Or visit https://docs.openclaw.ai for detailed instructions
The explicit command chaining of network retrieval into shell execution removes any inspection boundary and amplifies the risk of executing malicious or tampered content. In the context of a developer tool that already requests powerful browser and exec capabilities, this pattern is especially dangerous because users are likely to run it on privileged workstations.
# Install via official installer
curl -sSL https://install.openclaw.ai | sh
# Or visit https://docs.openclaw.ai for detailed instructions
The code silently captures sensitive request and response contents without any user-facing disclosure, consent flow, or visible indication. In context, this is more dangerous because the stated purpose is generic network monitoring, but the implementation collects complete content that users and site operators would reasonably expect to remain confined to the original application flow.
The XMLHttpRequest hooks duplicate the same risky behavior for XHR by globally logging request headers, bodies, and response contents. This broad interception increases coverage across legacy and modern apps alike, making accidental or malicious exposure of sensitive traffic more likely.
The template title and core instruction require document generation in Chinese, and there is no indication that the user may choose another language or locale. This is a natural-language policy concern because it imposes a fixed language by default rather than offering an explicit opt-in or documented justification.
The README promotes browser API interception and request/response logging but does not warn that captured traffic may include credentials, session tokens, personal data, or proprietary business information. In a tool explicitly designed to monitor live application traffic, omission of data-handling warnings increases the risk that users will collect and retain sensitive data unsafely.
The quick-start directs users to export full API logs and generate output artifacts without noting that those files can contain authentication headers, cookies, PII, and confidential payloads. Because the skill's main output is saved documentation and logs, this omission materially increases the chance of sensitive-data leakage to disk, version control, or downstream AI systems.
The skill explicitly promises to capture complete API request/response logs, packet-capture samples, and real interface data, but provides no warning or safeguards about credentials, session tokens, personal data, or confidential business records that may be collected and reproduced in generated documentation. In this context, the omission is dangerous because the stated purpose is to analyze internal office systems and produce reusable artifacts for AI-driven reconstruction, which materially increases the chance of broad sensitive-data exposure beyond the original system.
The package description is written entirely in Chinese and presents the skill's purpose only in that language, with no indication that users may choose another language or that the skill is region-specific. This creates a natural-language policy concern because it effectively imposes a locale/language constraint without opt-in or documented justification.
The manifest requests an 'exec' capability even though the stated purpose is browser API interception and documentation generation, which normally only needs browser/network access and file output. Granting command-execution authority unnecessarily expands the attack surface and would allow arbitrary local process execution if the skill or one of its dependencies is compromised.
Captured network data is stored on window and exposed through globally accessible helper functions, so any other script running in the page context can read the intercepted traffic. If third-party scripts, ads, compromised dependencies, or injected XSS execute on the page, they can trivially harvest the full network log.
The script intercepts all fetch traffic and records full URLs, headers, request bodies, and response bodies into a global log. This can capture credentials, session tokens, API keys, PII, and sensitive business data well beyond what is needed for basic diagnostics, creating a powerful in-page surveillance and data exposure mechanism.
The natural-language instructions and descriptions are entirely in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative is offered. The file does not state that the skill is region-specific or otherwise justify the fixed language choice.
The dependency on 'openclaw' is specified as '>=1.0.0', which permits installation of a wide range of versions and makes it impossible to verify whether known vulnerable releases are excluded. In combination with a package that also requests powerful capabilities, an unpinned dependency increases supply-chain risk and may expose users to known flaws in whatever version resolves at install time.
The script contains user-facing natural-language strings and comments in Chinese, including the file description and operational comments, while the error message is in English. This indicates an implicit language choice without user opt-in or a documented locale-specific justification, which matches the language/locale policy category.
The file header describes this as a 'network monitoring script', but the implemented behavior is simply to locate and print the contents of another JavaScript file. The inline comment on L13 further frames the action as outputting script content for injection, which diverges from the apparent monitoring/recording label and the code's actual passive file-read behavior.
The file comments and console-facing instructional messages are written in Chinese, including operational guidance shown at runtime. This can violate language/locale policy when a skill forces a specific language without user opt-in or justification.