ClawHub

OrderCLI Security Advisory

Security advisory for OrderCLI — 2 high/critical issues found on 2026-05-07T09:15:31Z

Audits

Pass
ClawScanPass

Agentic behavior and permission review.

Static analysisPass

Pattern checks against bundled files.

VirusTotalPass

Multi-engine malware detections and file reputation.

Install

openclaw skills install ordercli-security-advisory

OrderCLI Security Advisory

Date: 2026-05-07T09:15:31Z

Summary

Audit of /root/.openclaw/workspace/ordercli found 2 high/critical issues.

  • 🔴 Critical: 0
  • 🟠 High: 2
  • 🟡 Medium: 2

Findings

  • 🟡 MEDIUM: Some CRUD-like functions lack visible auth checks — manual review recommended
  • 🟠 HIGH: JSON is loaded without schema validation (1 json.load(s) calls, 0 validators)
  • 🟡 MEDIUM: File operations without try/except error handling
  • 🟠 HIGH: orders.json contains 3 PII field(s) — ensure access is restricted

Recommended Actions

  1. Fix all critical issues before any production deployment
  2. Rotate any exposed credentials immediately
  3. Add input validation and parameterized queries
  4. Restrict file permissions on data files containing PII
  5. Re-run audit after fixes: ./run-audit.sh /root/.openclaw/workspace/ordercli

Auto-generated by run-audit.sh