Security audit

ChatClaw — Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This cloud bridge is mostly coherent with its dashboard purpose, but it gives the remote service high-impact local control that is under-scoped and partly under-disclosed.

Review carefully before installing. This skill is a persistent cloud-connected control bridge, not just remote chat: it can send workspace file contents to ChatClaw, mutate local skill configuration, force reinstall skills, and manage scheduled agent jobs. Install only if you trust the ChatClaw account, relay service, and operators with that level of control, and prefer a version that requires local approval for file reads, skill replacement, and cron changes.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T06 · System Persistence

Error

Location: main.py:290
Finding: Undocumented Remote Creation and Control of Persistent Agent Jobs
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: main.py:259
Finding: Remote Forced Replacement of Executable Skill Packages
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: main.py:178
Finding: Cloud-Initiated Workspace File Content Exfiltration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: gateway_client.py:63
Finding: Excessive Operator Privileges Granted to a Persistent Cloud Bridge
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: relay_client.py:21
Finding: Unrestricted Relay URL Allows Plaintext or Attacker-Controlled Data Transport
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Known Vulnerable Dependency: cryptography==46.0.0 — 13 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +10 more

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is pinned to a version reported by the scanner as having multiple published advisories, including issues in bundled OpenSSL wheels and PKCS#7 decryption behavior. In a skill that connects to a cloud dashboard and likely handles encrypted network traffic, vulnerable cryptographic primitives or packaged crypto libraries can directly affect confidentiality, integrity, and authentication.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill explicitly states it will modify openclaw.json to enable a local chat-completions endpoint, while the high-level description presents the skill mainly as a dashboard connector. Even if intended, remotely mediated access combined with undeclared local configuration changes and possible task-scheduling functionality expands the attack surface and can leave operators unaware that the skill is altering local service exposure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill explicitly states it will modify openclaw.json to enable a local chat-completions endpoint, while the high-level description presents the skill mainly as a dashboard connector. Even if intended, remotely mediated access combined with undeclared local configuration changes and possible task-scheduling functionality expands the attack surface and can leave operators unaware that the skill is altering local service exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The client requests broad scopes including operator.admin, operator.approvals, and operator.pairing, which exceed the described need for dashboard chat, token tracking, read-only file browsing, and limited skills management. Excessive privileges increase blast radius if the skill is misused or compromised, enabling actions beyond user expectations and violating least privilege.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implemented capability set materially exceeds the declared skill purpose: in addition to chat and read-only file browsing, the client can create, modify, delete, and force-run cron jobs. That is a dangerous scope/behavior mismatch because downstream users, policy engines, or reviewers may authorize the skill under the assumption it is limited, while it actually has persistent execution and task-triggering power.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill accepts remote cloud messages that invoke local subprocesses to change skill enablement and reinstall packages via OpenClaw/ClawHub CLI. That gives the remote dashboard effective administrative control over local extensions, which can alter security posture or install untrusted code if the cloud account, API key, or relay channel is compromised.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · relay_client.py (reported line 83)May include surrounding context.
python
logger.debug(f"Local → Cloud: {json.dumps(message)[:200]}") async def close(self) -> None: """Gracefully close the connection and reset state.""" self._connected.clear() if self.ws: await self.ws.close()

Known Vulnerable Dependency: aiohttp==3.11.18 — 16 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +13 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The pinned aiohttp version is flagged with multiple advisories affecting cookie handling, header construction, and multipart parsing. Because this skill communicates with a remote cloud dashboard and may process HTTP responses, sessions, and uploaded/downloaded data, these flaws could enable request/response smuggling, session scope issues, or denial of service depending on how the library is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README prominently advertises remote chat, token tracking, task management, and message relaying to a cloud dashboard, but does not clearly warn users that prompts, responses, metadata, and possibly workspace-derived content may leave the local machine and transit a third-party service. This omission can cause users to enable the skill without informed consent about privacy and data handling, which is especially sensitive for agent workflows that may process secrets, proprietary code, or internal documents.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest frames the skill as providing remote chat, tracking, task management, read-only file browsing, and limited skills management. The README indicates the skill can change local gateway configuration or state by auto-enabling an HTTP endpoint, which is a broader write/action capability than the mostly access-oriented description suggests.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares substantial capabilities—network access, file read/write, environment access, and shell execution—but does not expose an explicit permission or allowed-tools declaration. That makes the trust boundary opaque to operators while the skill can modify local configuration, access authentication material, invoke local CLIs, and maintain a cloud relay, which materially increases the risk of overprivileged deployment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Encouraging users to paste a setup prompt pre-filled with the API key directly into an agent chat creates a natural-language secret exfiltration path. Once the key is placed in chat context, it may be logged, retained in transcripts, forwarded through the relay, or exposed to other tools and prompts, violating basic secret-handling practices.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The code exposes direct cron deletion through cron_remove() with no built-in confirmation, safety interlock, or audit-oriented prompt. In a remote dashboard/control skill, this makes destructive action easier to trigger accidentally or via a confused-deputy flow, potentially disrupting scheduled automation or persistence visibility.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: On enable, the skill silently rewrites the core OpenClaw configuration to enable the chatCompletions HTTP endpoint. Even if intended for functionality, modifying global platform configuration without explicit user consent expands the agent's attack surface and may expose a local endpoint other components can abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill automatically rewrites openclaw.json during enablement, without an explicit warning in this code path that a core local config file will be changed. Automatic local configuration mutation is risky because it can unexpectedly enable new listening functionality and make incident review harder if users did not knowingly approve the change.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The files.get path retrieves local file contents from the gateway and sends them to the cloud relay without any local confirmation or warning in this file. Since the skill is specifically a remote dashboard bridge, this materially increases the danger: anyone controlling the remote channel can browse and exfiltrate workspace contents within the gateway's allowed scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Remote messages can trigger subprocess-backed state changes such as enabling/disabling skills and reinstalling them, with no explicit user warning or approval path shown here. In the context of a cloud-connected bot management skill, this is especially dangerous because it turns a remote control channel into privileged local administration over installed code.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code exposes remote cron management operations (list/add/update/remove/trigger) through the cloud relay, but the disclosed metadata only mentions chat, token tracking, file browsing, and skills management. This capability gap is security-relevant because a user may authorize a chat/file browsing bridge without realizing it also grants persistent task creation and execution control to the remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This client establishes a persistent WebSocket to a cloud relay and is explicitly designed to transmit agent messages between a local environment and a remote dashboard. In the context of a skill that also advertises remote chat, token tracking, workspace file browsing, and skills management, sending data off-host without an explicit user-facing consent/notice mechanism creates a real privacy and data-exposure risk, even if transport security is used.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The in-code documentation says the relay handles file browsing and chat dispatch, but omits the implemented cron and skills control functions. In a security-sensitive integration, incomplete documentation is a real transparency problem because reviewers and users may underestimate the authority granted to the remote service.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: gateway_client.py:113