ClawHub
Back to skill

Security audit

Clawbuddy Litekit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a dashboard launcher and status checker whose external service and OpenClaw secret use are visible and aligned with its purpose.

Install only if you are comfortable using the hosted ClawBuddy dashboard and its Lovable/Supabase backend with your OpenClaw environment. Treat OPENCLAW_API_KEY as sensitive: use a scoped or revocable key if possible, store it only in the intended cloud secret manager, and rotate it if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill instructs users to run scripts that open a live dashboard and setup flow, which likely triggers browser/network access to an external service, but it does not warn about this behavior. Even if the destination is legitimate, silently directing users to external resources can enable phishing-like workflows, privacy leakage, or unexpected environment changes.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The setup guidance tells users to provision `OPENCLAW_API_KEY` and gateway secrets in a cloud environment without any credential-handling warning. This normalizes secret entry without emphasizing secure storage, least privilege, rotation, and non-disclosure, increasing the chance of accidental exposure through logs, screenshots, copy/paste, or misconfiguration.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script silently makes an outbound network request and includes embedded authentication material in headers, which can surprise users and normalize undisclosed credentialed calls. In the context of an agent skill advertised as opening a dashboard, this hidden backend communication is more concerning because users may not expect execution to contact a remote service or reveal deployment metadata.

Static analysis

No suspicious patterns detected.