Security audit
Security checks for vulnerabilities and agentic risk
This Pane integration is mostly disclosed, but its delayed cron follow-ups can keep acting later in a workspace session without fresh approval.
Install only if you want an agent to use your paired Pane Gateway token to create, edit, and inspect Pane workspace content. Confirm PANE_GATEWAY_URL points to your trusted local gateway, protect PANE_GATEWAY_TOKEN, avoid insecure TLS outside development, and be aware that the skill may schedule one-shot follow-up actions for multi-step Pane session work.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
curl -sS "$PANE_GATEWAY_URL/v1/health" | jq -r '.tls_cert_pem' > /tmp/pane-gateway.pem
curl -sS --cacert /tmp/pane-gateway.pem "$PANE_GATEWAY_URL/v1/health"
2. Skip verification (dev only). If PANE_GATEWAY_INSECURE_TLS=1 is set,
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
curl -sS "$PANE_GATEWAY_URL/v1/health" | jq -r '.tls_cert_pem' > /tmp/pane-gateway.pem
curl -sS --cacert /tmp/pane-gateway.pem "$PANE_GATEWAY_URL/v1/health"
2. Skip verification (dev only). If PANE_GATEWAY_INSECURE_TLS=1 is set,
The skill description says it can create notes, tasks, and projects, but the API reference explicitly states the corresponding resource endpoints do not exist and that such operations must instead be routed through conversational session flow. This mismatch can cause agents to improvise by sending free-form instructions to an LLM-backed session to perform actions indirectly, reducing determinism, auditability, and policy control over what operations are actually executed.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Unreachable/blocked-in-v1 endpoints
These do **not** exist on the gateway and should never be constructed:
`POST/GET/PUT/DELETE /v1/notes*`, `/v1/tasks*`, `/v1/projects*`,
`/v1/folders*`. Requests to any of these hit the router's fallback handler
(404). Use the conversational session flow in `SKILL.md` instead.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS "$PANE_GATEWAY_URL/v1/health" | jq -r '.tls_cert_pem' > /tmp/pane-gateway.pem
CACERT=/tmp/pane-gateway.pem
curl -sS --cacert "$CACERT" \
-X POST "$PANE_GATEWAY_URL/pair" \
-H "Content-Type: application/json" \
-d '{"code":"123456"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS "$PANE_GATEWAY_URL/v1/health" | jq -r '.tls_cert_pem' > /tmp/pane-gateway.pem
curl -sS --cacert /tmp/pane-gateway.pem "$PANE_GATEWAY_URL/v1/health"
2. Skip verification (dev only). If PANE_GATEWAY_INSECURE_TLS=1 is set,
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
curl -sS --cacert /tmp/pane-gateway.pem "$PANE_GATEWAY_URL/v1/health"
**2. Skip verification (dev only).** If `PANE_GATEWAY_INSECURE_TLS=1` is set,
use `-k`/`--insecure`. Do not default to this silently — only use it when the
env var is explicitly set, and mention to the user that verification is
skipped.
This sends arbitrary user-supplied content into a privileged Pane session where Pane's in-app AI may invoke internal tools such as creating or editing notes, tasks, or projects. Because the skill explicitly relies on natural-language interpretation by another agent-like component, prompt injection or ambiguous instructions can cause unintended state-changing actions inside the user's workspace.
SESSION_ID=$(echo "$SESSION" | jq -r '.session_id')
# 2. Send a message describing the desired note
curl -sS --cacert "$CACERT" \
-X POST "$PANE_GATEWAY_URL/v1/sessions/$SESSION_ID/messages" \
-H "Authorization: Bearer $PANE_GATEWAY_TOKEN" \
-H "Content-Type: application/json" \
The skill expands its scope from operating a local Pane gateway to scheduling future autonomous actions via openclaw cron add. That creates persistence and delayed execution beyond the user's immediate request, which can be abused to continue acting in the same session without fresh confirmation and increases the blast radius if prompts are ambiguous or malicious.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS --cacert "$CACERT" "$PANE_GATEWAY_URL/v1/health"
# Authenticated (fuller response incl. oc_connection_status):
curl -sS --cacert "$CACERT" "$PANE_GATEWAY_URL/v1/health" \
-H "Authorization: Bearer $PANE_GATEWAY_TOKEN"
The documented POST /v1/chat/completions capability is broader than the skill metadata suggests, enabling arbitrary stateless LLM interactions outside the Pane session/history model. This expands the effective authority of the skill and can mislead users or higher-level policy into granting a tool more capability than advertised, which is a scope/intent mismatch with security implications.
The manifest centers the skill on creating/managing Pane content via chat sessions and managing AI sessions. The direct POST /v1/chat/completions proxy is a more general-purpose LLM completion capability outside Pane sessions, which goes beyond the stated session-oriented Pane operation scope.