Security audit

Clawmeter

Security checks for vulnerabilities and agentic risk

Overview

ClawMeter is a coherent cost dashboard, but its unauthenticated local server, misleading local-only claims, and browser rendering flaws create review-worthy exposure risks.

Review this carefully before installing. Use it only on a trusted local machine, do not expose port 3377 to a network, and avoid systemd or reverse-proxy deployment until the server binds explicitly to loopback, authentication is added, dashboard HTML escaping is fixed, remote scripts are pinned or bundled, and dependencies are updated.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: src/server.mjs:84
Finding: Unauthenticated API May Be Exposed on All Network Interfaces
Content: View full analysis
console.log(`🔥 ClawMeter running at http://localhost:${config.port}`)); ``` ### Technical Analysis The server starts without specifying a listening hostname. Depending on the Node.js runtime and operating-system configuration, this can bind the Express application to all available interfaces rather than exclusively to the loopback interface. This behavior conflicts with the documentation's claim that the service is local-only. The application also implements no authentication or authorization for its API endpoints. Exposed endpoints include: - `/api/summary` - `/api/daily` - `/api/sessions` - `/api/models` - `/api/top-sessions` - `/api/alerts` - `POST /api/ingest` These endpoints reveal session identifiers, agent names, model and provider names, token counts, timestamps, spending data, budgets, and alert history. The ingestion endpoint also allows any reachable client to trigger filesystem scanning and database processing. ### Attack Path 1. A user starts ClawMeter on a workstation or server. 2. The application listens on port 3377 without explicitly restricting the listener to `127.0.0.1` or `::1`. 3. An attacker on a reachable network discovers port 3377 through service enumeration or a direct request. 4. The attacker requests endpoints such as `/api/sessions`, `/api/models`, and `/api/alerts`. 5. The application returns private usage metadata without authentication. 6. The attacker may repeatedly invoke `POST /api/ingest`, causing repeated session-directory scans, JSONL parsing, aggregate rebuilding, and database writes. If the port is exposed through a firewall, container mapping, reverse proxy, or cloud security group, the same path may be exploitable remotely. ### Impact Assessment An unauthenticated at ...[truncated 493 chars]
Remediation: View remediation
{ console.log(`ClawMeter running at http://${host}:${config.port}`); }); ``` 2. If IPv6 loopback support is required, configure it deliberately and test that the service is not reachable through external interfaces. 3. Add authentication before supporting remote access. Suitable controls include: - A random bearer token stored outside source control - Authenticated reverse-proxy access - Mutual TLS for managed deployments - SSO for team environments 4. Require authorization for `POST /api/ingest` and apply rate limiting. 5. Add request throttling and concurrency controls so repeated ingestion requests cannot overlap or exhaust resources. 6. Update startup logs and documentation so they report the actual listening address rather than implying a localhost-only binding. 7. Add an automated test that verifies the default service is unreachable through non-loopback interfaces. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: web/index.html:806
Finding: Stored DOM-Based Cross-Site Scripting Through Log-Controlled Model Names
Content: View full analysis
{ const pct = total > 0 ? (r.total_cost / total * 100).toFixed(1) : '0.0'; return `
${r.model || 'unknown'} ${fmt(r.total_cost)} ${pct}%
`; }).join(''); ``` The same unsafe pattern is also used when model values are rendered in the top-session and recent-session tables at `web/index.html:827-847`. ### Technical Analysis OpenClaw JSONL files are treated as data, but fields such as ` ...[truncated 2118 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: web/index.html:7
Finding: Unpinned Third-Party JavaScript Executes with Dashboard-Origin Access
Content: View full analysis
``` ### Technical Analysis The dashboard executes Chart.js directly from a third-party CDN using a mutable major-version reference. The URL does not pin an exact package version and does not provide a Subresource Integrity hash. A script loaded this way executes with the same browser privileges as the dashboard's own JavaScript. It can issue same-origin requests to ClawMeter API endpoints and read the responses. The lockfile does not protect this browser dependency because the page bypasses the locally installed dependency graph and retrieves the script directly at runtime. The absence of an integrity hash means the browser cannot verify that the downloaded resource matches a reviewed artifact. ### Attack Path 1. A user opens the ClawMeter dashboard. 2. The browser requests `chart.js@4` from jsDelivr. 3. The CDN resolves the mutable version reference and returns executable JavaScript. 4. If the upstream package, package-publishing account, CDN, or resolution process is compromised, malicious JavaScript is returned. 5. The browser executes that JavaScript in the ClawMeter origin. 6. The malicious dependency requests endpoints such as `/api/sessions`, `/api/models`, and `/api/alerts`. 7. The script transmits the collected data to an attacker-controlled endpoint or modifies the dashboard. This exploitation requires a supply-chain or CDN compromise, but the affected code would execute automatically whenever users load the page. ### Impact Assessment A compromised remote script could: - Read all APIs available to the dashboard - Exfiltrate session and spending metadata - Trigger ingestion requests - Falsify charts and cost displays - Capture future data loaded during dashboard polling - Aff ...[truncated 169 chars]
Remediation: View remediation
``` 4. Add a Content Security Policy restricting `script-src` to approved sources. Prefer a policy that permits only local scripts. 5. Apply the same supply-chain policy to other remote page resources where practical, including externally hosted fonts. 6. Document the process for reviewing and updating frontend dependencies so version and integrity changes require explicit approval. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (72)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CONTRIBUTING.md (reported line 438)May include surrounding context.
res.json(result); });

text
2. Update SKILL.md with endpoint documentation 3. Add example usage in README.md 4. Test manually: `curl http://localhost:3377/api/your-endpoint` 5. Submit PR

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONTRIBUTING.md (reported line 127)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_SUMMARY.md (reported line 121)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_SUMMARY.md (reported line 134)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_SUMMARY.md (reported line 162)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PACKAGE_SUMMARY.md (reported line 199)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PUBLISHING.md (reported line 26)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 54)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 63)May include surrounding context.
md
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-skill.sh (reported line 36)May include surrounding context.
sh
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-skill.sh (reported line 39)May include surrounding context.
sh
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-skill.sh (reported line 41)May include surrounding context.
sh
- [x] **Comments** — Key functions documented - [x] **Error handling** — Graceful failures, no crashes - [x] **ES modules** — Modern JavaScript (import/export) - [x] **No hardcoded secrets** — Uses .env for configuration ### Configuration ✅

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONTRIBUTING.md (reported line 126)May include surrounding context.
2. Configure

bash
cp .env.example .env

Edit .env to set your OpenClaw agents directory (defaults to ~/.openclaw/agents):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 38)May include surrounding context.
2. Configure

bash
cp .env.example .env

Edit .env to set your OpenClaw agents directory (defaults to ~/.openclaw/agents):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 53)May include surrounding context.
2. Configure

bash
cp .env.example .env

Edit .env to set your OpenClaw agents directory (defaults to ~/.openclaw/agents):

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document claims 'No external network access' in the security model, yet the architecture earlier describes outbound Telegram Bot API and SMTP email notifications. This mismatch can mislead operators into deploying the system under incorrect assumptions, causing unintended data egress and weakening threat modeling, firewall policy, and privacy review.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The explicit command rm -rf ~/.openclaw/workspace/clawmeter is destructive and lacks safeguards or warnings. In a quickstart context, users often copy-paste commands, so documentation should reduce the chance of accidental deletion and path mistakes.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 367)May include surrounding context.
md
# Stop the server (Ctrl+C or kill process) # Remove files rm -rf ~/.openclaw/workspace/clawmeter # Remove skill (if installed) rm -rf ~/.openclaw/skills/clawmeter

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The explicit command rm -rf ~/.openclaw/workspace/clawmeter is destructive and lacks safeguards or warnings. In a quickstart context, users often copy-paste commands, so documentation should reduce the chance of accidental deletion and path mistakes.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 367)May include surrounding context.
md
# Stop the server (Ctrl+C or kill process) # Remove files rm -rf ~/.openclaw/workspace/clawmeter # Remove skill (if installed) rm -rf ~/.openclaw/skills/clawmeter

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The explicit command rm -rf ~/.openclaw/skills/clawmeter permanently deletes the installed skill directory and may remove local modifications or related files without confirmation. This is dangerous as written because the docs do not emphasize irreversibility or path verification.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 370)May include surrounding context.
rm -rf ~/.openclaw/workspace/clawmeter

Remove skill (if installed)

rm -rf ~/.openclaw/skills/clawmeter

Database is self-contained, so no external cleanup needed

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The explicit command rm -rf ~/.openclaw/skills/clawmeter permanently deletes the installed skill directory and may remove local modifications or related files without confirmation. This is dangerous as written because the docs do not emphasize irreversibility or path verification.
Content: Scanner excerpt · docs/QUICKSTART.md (reported line 370)May include surrounding context.
rm -rf ~/.openclaw/workspace/clawmeter

Remove skill (if installed)

rm -rf ~/.openclaw/skills/clawmeter

Database is self-contained, so no external cleanup needed

text

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The lockfile includes nodemailer 6.10.1, which is flagged with multiple advisories including header injection, content resolution bypass, and denial-of-service issues. Because Nodemailer handles externally influenced email headers, addresses, attachments, and content sources, these vulnerabilities can enable abuse such as SMTP/header injection, local or remote content access bypasses, or service disruption if the application exposes mail-sending features.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

Category: Supply Chain
Confidence: 92% confidence
Finding: path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS conditions involving crafted route patterns or matching behavior. In an Express-based service, route processing is on the request path, so a parser or matcher denial of service can materially affect availability if attacker-controlled inputs reach vulnerable matching logic or if the app uses unsafe dynamic routes.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: nodemailer==6.10.1 — 12 advisory(ies): CVE-2026-82661 (Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary); GHSA-2x7j-588g-ccc2 (Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote den); GHSA-8m3c-c648-2xjj (Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disable) +9 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency specification ^6.9.0 can resolve to nodemailer 6.10.1, which is flagged with multiple advisories including header injection, denial of service, and file/content access bypass issues. Because this project is a dashboard/monitoring service and email functionality is plausible for alerting, a vulnerable mail library in a server-side context could expose the application to abuse if any user-controlled content is ever incorporated into outgoing messages.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Self-Modification

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

2. Configure

Credential Access

2. Configure

Credential Access

2. Configure

Intent-Code Divergence

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Remove skill (if installed)

Database is self-contained, so no external cleanup needed

Tool Parameter Abuse

Remove skill (if installed)

Database is self-contained, so no external cleanup needed

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

Static analysis