OpenClaw Bot Dashboard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:46 AM UTC
• Version: 1.0.5

Overview

This skill is a real dashboard launcher, but it automatically downloads and runs mutable remote code, stops local processes, and reads OpenClaw configuration with too little user control.

Install only if you are comfortable letting this skill fetch and run the latest code from the author's GitHub repository, install npm dependencies, stop whatever is using port 3000, and allow the dashboard to read your OpenClaw config. Safer use would require pinned releases, checksum or signature verification, explicit confirmation before updates/deletes/process kills, and redaction or sandboxing for configuration data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:144

Finding

Unpinned Remote Code Is Downloaded, Installed, and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:144-220
Vulnerability Type: Mutable remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

# macOS/Linux
mkdir -p ~/projects
cd ~/projects
git clone https://github.com/xmanrui/OpenClaw-bot-review.git

bash

mkdir -p ~/projects
cd ~/projects
curl -L https://github.com/xmanrui/OpenClaw-bot-review/archive/refs/heads/main.zip -o openclaw-dashboard.zip
unzip openclaw-dashboard.zip
mv OpenClaw-bot-review-main OpenClaw-bot-review
rm openclaw-dashboard.zip

bash

# macOS/Linux
cd ~/projects/OpenClaw-bot-review
npm install

bash

# macOS/Linux
cd ~/projects/OpenClaw-bot-review
npm run dev > /dev/null 2>&1 &

The equivalent Windows instructions use git clone, Invoke-WebRequest, npm install, and npm run dev, producing the same security exposure.

Technical Analysis

The Skill retrieves the current contents of the unpinned main branch of a personal GitHub repository and then executes repository-controlled code. It does not pin an immutable commit or release, verify a cryptographic digest or signature, or include the dashboard source in the audited package.

Running npm install is itself a code-execution boundary because package lifecycle hooks such as preinstall, install, and postinstall can execute arbitrary commands. Running npm run dev then directly executes scripts selected by the downloaded repository.

The update instructions at SKILL.md:87-111 also use git fetch, git pull origin main, and another npm install. Consequently, even a previously inspected installation can silently acquire different executable behavior. SKILL.md:367 explicitly states that no user confirmation is needed.

Although downloading a dashboard is consistent with the declared functionality, retrieving and executing the latest mutable source without integrity controls exce ...[truncated 1611 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor the complete dashboard implementation into the reviewed package, or pin downloads to a specific immutable commit or signed release.
2. Publish and verify a SHA-256 or stronger digest before extracting or executing an archive.
3. Verify release signatures against a documented, trusted signing key.
4. Commit and enforce a lockfile, then use npm ci rather than npm install.
5. Use npm ci --ignore-scripts unless lifecycle scripts are strictly required and individually audited.
6. Require explicit user approval before downloading, updating, installing dependencies, or starting newly downloaded code.
7. Display the source URL, pinned revision, integrity value, and proposed commands in the approval prompt.
8. Execute the dashboard in a restricted account, container, or sandbox with a read-only filesystem and tightly limited network access.
9. Do not automatically track main; provide reviewed, versioned upgrades with rollback support.
10. Audit the dashboard repository and its complete dependency graph as part of the Skill release process.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:55

Finding

Arbitrary Process on Port 3000 Is Forcibly Terminated

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-75 and SKILL.md:301-315
Vulnerability Type: Unverified process termination and denial of service
Risk Level: High

Vulnerable Code

bash

lsof -ti:3000 | xargs kill -9 2>/dev/null

powershell

Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process -Force

cmd

for /f "tokens=5" %a in ('netstat -ano ^| findstr :3000') do taskkill /F /PID %a

The same unconditional forced-termination commands are repeated in the server-stopping instructions at SKILL.md:301-315.

Technical Analysis

The Skill identifies a process solely by whether it owns TCP port 3000. It does not verify the process executable, command line, working directory, user, start time, or a Skill-created PID record before terminating it.

kill -9, Stop-Process -Force, and taskkill /F do not permit graceful cleanup. They can terminate an unrelated development server, production service, editor component, or other application that happens to use the same port.

Launching the dashboard does not require authority to terminate arbitrary processes. The least-privilege behavior would be to reuse a verified dashboard instance, select another available port, or request user approval when ownership cannot be established.

Attack Path

1. A legitimate unrelated application listens on port 3000.
2. The user asks the Agent to launch the OpenClaw dashboard.
3. The Skill obtains the PID owning port 3000 without determining whether it belongs to the dashboard.
4. The Skill forcibly terminates that PID.
5. The unrelated application becomes unavailable and may lose unsaved state or corrupt in-progress data.
6. The Skill starts its downloaded dashboard in place of the terminated application.

An attacker able to induce activation of the Skill could use this behavior as a targeted local denial-of-service primitive against a known service on ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Store a PID file when the Skill starts the dashboard and only stop the recorded process.
2. Before termination, verify the PID's executable, command line, working directory, and start time.
3. Confirm that the process was launched from the expected pinned dashboard installation.
4. If port 3000 belongs to an unknown process, do not terminate it automatically. Ask the user for confirmation or choose an unused port.
5. Prefer graceful termination with a timeout before considering a forced kill.
6. Check whether an existing process is already a healthy dashboard and reuse it when appropriate.
7. Bind the selected port explicitly and report the actual port in both returned URLs.
8. Avoid running the Agent or dashboard with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Mutable Third-Party Dashboard Is Granted Access to Sensitive OpenClaw Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-43 and SKILL.md:327-329
Vulnerability Type: Excessive sensitive-file exposure to unaudited code
Risk Level: High

Vulnerable Code

text

## Prerequisites

- Node.js 18+ must be installed
- OpenClaw config at `~/.openclaw/openclaw.json` (or `%USERPROFILE%\.openclaw\openclaw.json` on Windows)

text

- Dashboard reads config directly from `~/.openclaw/openclaw.json` - no database needed

The same behavior is disclosed in README.md:89 and README.md:118.

Technical Analysis

The dashboard is expected to read the complete OpenClaw configuration directly from the user's home directory. The audited package does not define a redacted data interface, constrain which fields the dashboard may read, or provide a sandbox that limits filesystem and network access.

This exposure is particularly dangerous when combined with the unpinned remote execution channel: the code receiving access to the configuration can change whenever the remote main branch or its dependencies change.

The audited Markdown files contain no direct command that uploads openclaw.json, so actual credential exfiltration is not confirmed. Nevertheless, giving mutable, unaudited code direct access to a potentially sensitive configuration file creates an unnecessary trust boundary and fails least-privilege design.

Attack Path

1. The Skill downloads or updates the dashboard from the mutable remote branch.
2. The dashboard or one of its dependencies is modified maliciously or compromised.
3. The Skill executes the dashboard under the user's account.
4. The dashboard reads ~/.openclaw/openclaw.json as explicitly intended.
5. Malicious runtime code extracts any credentials, provider settings, model configuration, agent metadata, or other sensitive fields present in the file.
6. Because the runtime is not sandboxed, it can use ordinary network APIs to transmit coll ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not give the dashboard direct access to the complete configuration file.
2. Introduce a trusted local adapter that parses the configuration and returns only fields required for display.
3. Remove or mask API keys, tokens, passwords, cookies, private endpoints, and other secret-bearing fields before data reaches the dashboard.
4. Provide the dashboard with a generated read-only snapshot rather than the original file.
5. Run the dashboard in a sandbox that cannot read the user's home directory except for the sanitized input.
6. Bind the server to 127.0.0.1 by default. Require explicit informed approval before exposing it on a LAN interface.
7. Apply a restrictive content security policy and disable unnecessary outbound network access.
8. Pin, verify, and audit the dashboard code and dependencies before granting any configuration access.
9. Document precisely which configuration fields are read, retained, displayed, logged, or transmitted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The explicit command rm -rf ~/projects/OpenClaw-bot-review is a true destructive operation and not a false positive in this context. Because the skill is designed for autonomous execution, embedding a forced delete path materially raises the risk of accidental or repeated data loss, especially if the directory contains local modifications or if path assumptions are wrong.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

• Remove old project directory:

  bash

  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"
  

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The explicit command rm -rf ~/projects/OpenClaw-bot-review is a true destructive operation and not a false positive in this context. Because the skill is designed for autonomous execution, embedding a forced delete path materially raises the risk of accidental or repeated data loss, especially if the directory contains local modifications or if path assumptions are wrong.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

• Remove old project directory:

  bash

  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"
  

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub install openclaw-bot-dashboard without pinning a specific package version. npx resolves and executes the latest published package by default, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed; this is more concerning here because the skill also automates downloading code, installing dependencies, and starting services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README also recommends npx skills add xmanrui/openclaw-bot-dashboard without a pinned version for the skills package. This exposes users to the same remote code execution and supply-chain risk from whatever package version is current at execution time, and the danger is amplified because the installed skill performs OS detection, dependency installation, update pulls, and background process management.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase set includes broad natural-language commands such as open bot review, launch bot review, and start dashboard, which can plausibly occur in ordinary conversation. In an agent environment, overly broad triggers can cause unintended activation of a skill that stops services, downloads code, runs npm install, and launches a background web server, turning accidental invocation into a meaningful security and safety issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes destructive and system-affecting behavior including stopping an existing service, pulling or re-downloading code, installing dependencies, and starting a background process, but it does not present a clear up-front warning or ask for explicit user consent. This is dangerous because users may invoke what appears to be a simple dashboard opener while actually authorizing process termination, filesystem changes, network downloads, and execution of newly fetched code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The metadata description advertises broad trigger phrases including "open bot dashboard" and "open bot review," which are not sufficiently scoped to this specific skill. In context, broad activation is dangerous because invocation causes command execution, package installation, process termination, and repository download without further validation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation list includes generic phrases like "open bot review," "launch bot review," and "start dashboard," which can plausibly occur in normal conversation and trigger the skill unexpectedly. Because this skill performs side-effectful actions such as killing processes, downloading code, installing dependencies, and starting services, accidental invocation increases the risk of unintended local system changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly instructs the agent to kill whatever is listening on port 3000 and, in some branches, delete the existing project directory, all without a clear up-front user warning or confirmation. These are destructive side effects that can terminate unrelated applications, remove local data, and disrupt ongoing work if the port or directory is being used for something else.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The required return formats are fully specified in Chinese and use imperative language such as "You MUST return both" and fixed Chinese response templates. This forces a specific language for the user-facing output without opt-in, even though the skill otherwise mentions i18n support.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list contains generic phrases such as "start dashboard", "open bot review", and "openclaw dashboard" that may match ordinary user requests outside a clearly scoped invocation. This can cause unintended activation of a skill that launches or manages local services, increasing the risk of surprise execution, dependency installation, or network activity without explicit user intent.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

md

- "launch bot review"
- "start dashboard"

The skill will automatically handle everything and give you the access URL!

## 🌟 Features

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill states that it reads the local OpenClaw configuration file directly but does not provide an up-front privacy notice or explain what data may be exposed through the dashboard. Since configuration files often contain tokens, endpoints, model settings, or session metadata, silently accessing them can create privacy and credential exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.