OpenClaw Bot Dashboard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:46 AM UTC
• Version: 1.0.5

Overview

This skill is a real dashboard launcher, but it automatically downloads and runs mutable remote code, stops local processes, and reads OpenClaw configuration with too little user control.

Install only if you are comfortable letting this skill fetch and run the latest code from the author's GitHub repository, install npm dependencies, stop whatever is using port 3000, and allow the dashboard to read your OpenClaw config. Safer use would require pinned releases, checksum or signature verification, explicit confirmation before updates/deletes/process kills, and redaction or sandboxing for configuration data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:144
• Finding: Unpinned Remote Code Is Downloaded, Installed, and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md:144-220` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # macOS/Linux mkdir -p ~/projects cd ~/projects git clone https://github.com/xmanrui/OpenClaw-bot-review.git ``` ```bash mkdir -p ~/projects cd ~/projects curl -L https://github.com/xmanrui/OpenClaw-bot-review/archive/refs/heads/main.zip -o openclaw-dashboard.zip unzip openclaw-dashboard.zip mv OpenClaw-bot-review-main OpenClaw-bot-review rm openclaw-dashboard.zip ``` ```bash # macOS/Linux cd ~/projects/OpenClaw-bot-review npm install ``` ```bash # macOS/Linux cd ~/projects/OpenClaw-bot-review npm run dev > /dev/null 2>&1 & ``` The equivalent Windows instructions use `git clone`, `Invoke-WebRequest`, `npm install`, and `npm run dev`, producing the same security exposure. ### Technical Analysis The Skill retrieves the current contents of the unpinned `main` branch of a personal GitHub repository and then executes repository-controlled code. It does not pin an immutable commit or release, verify a cryptographic digest or signature, or include the dashboard source in the audited package. Running `npm install` is itself a code-execution boundary because package lifecycle hooks such as `preinstall`, `install`, and `postinstall` can execute arbitrary commands. Running `npm run dev` then directly executes scripts selected by the downloaded repository. The update instructions at `SKILL.md:87-111` also use `git fetch`, `git pull origin main`, and another `npm install`. Consequently, even a previously inspected installation can silently acquire different executable behavior. `SKILL.md:367` explicitly states that no user confirmation is needed. Although downloading a dashboard is consistent with the declared functionality, retrieving and executing the latest mutable source without integrity controls exce ...[truncated 1611 chars]
• Remediation: ## Remediation Suggestions 1. Vendor the complete dashboard implementation into the reviewed package, or pin downloads to a specific immutable commit or signed release. 2. Publish and verify a SHA-256 or stronger digest before extracting or executing an archive. 3. Verify release signatures against a documented, trusted signing key. 4. Commit and enforce a lockfile, then use `npm ci` rather than `npm install`. 5. Use `npm ci --ignore-scripts` unless lifecycle scripts are strictly required and individually audited. 6. Require explicit user approval before downloading, updating, installing dependencies, or starting newly downloaded code. 7. Display the source URL, pinned revision, integrity value, and proposed commands in the approval prompt. 8. Execute the dashboard in a restricted account, container, or sandbox with a read-only filesystem and tightly limited network access. 9. Do not automatically track `main`; provide reviewed, versioned upgrades with rollback support. 10. Audit the dashboard repository and its complete dependency graph as part of the Skill release process.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:55
• Finding: Arbitrary Process on Port 3000 Is Forcibly Terminated## Vulnerability Details **File Location**: `SKILL.md:55-75` and `SKILL.md:301-315` **Vulnerability Type**: Unverified process termination and denial of service **Risk Level**: High ### Vulnerable Code ```bash lsof -ti:3000 | xargs kill -9 2>/dev/null ``` ```powershell Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process -Force ``` ```cmd for /f "tokens=5" %a in ('netstat -ano ^| findstr :3000') do taskkill /F /PID %a ``` The same unconditional forced-termination commands are repeated in the server-stopping instructions at `SKILL.md:301-315`. ### Technical Analysis The Skill identifies a process solely by whether it owns TCP port 3000. It does not verify the process executable, command line, working directory, user, start time, or a Skill-created PID record before terminating it. `kill -9`, `Stop-Process -Force`, and `taskkill /F` do not permit graceful cleanup. They can terminate an unrelated development server, production service, editor component, or other application that happens to use the same port. Launching the dashboard does not require authority to terminate arbitrary processes. The least-privilege behavior would be to reuse a verified dashboard instance, select another available port, or request user approval when ownership cannot be established. ### Attack Path 1. A legitimate unrelated application listens on port 3000. 2. The user asks the Agent to launch the OpenClaw dashboard. 3. The Skill obtains the PID owning port 3000 without determining whether it belongs to the dashboard. 4. The Skill forcibly terminates that PID. 5. The unrelated application becomes unavailable and may lose unsaved state or corrupt in-progress data. 6. The Skill starts its downloaded dashboard in place of the terminated application. An attacker able to induce activation of the Skill could use this behavior as a targeted local denial-of-service primitive against a known service on ...[truncated 651 chars]
• Remediation: ## Remediation Suggestions 1. Store a PID file when the Skill starts the dashboard and only stop the recorded process. 2. Before termination, verify the PID's executable, command line, working directory, and start time. 3. Confirm that the process was launched from the expected pinned dashboard installation. 4. If port 3000 belongs to an unknown process, do not terminate it automatically. Ask the user for confirmation or choose an unused port. 5. Prefer graceful termination with a timeout before considering a forced kill. 6. Check whether an existing process is already a healthy dashboard and reuse it when appropriate. 7. Bind the selected port explicitly and report the actual port in both returned URLs. 8. Avoid running the Agent or dashboard with administrator or root privileges.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39
• Finding: Mutable Third-Party Dashboard Is Granted Access to Sensitive OpenClaw Configuration## Vulnerability Details **File Location**: `SKILL.md:39-43` and `SKILL.md:327-329` **Vulnerability Type**: Excessive sensitive-file exposure to unaudited code **Risk Level**: High ### Vulnerable Code ```text ## Prerequisites - Node.js 18+ must be installed - OpenClaw config at `~/.openclaw/openclaw.json` (or `%USERPROFILE%\.openclaw\openclaw.json` on Windows) ``` ```text - Dashboard reads config directly from `~/.openclaw/openclaw.json` - no database needed ``` The same behavior is disclosed in `README.md:89` and `README.md:118`. ### Technical Analysis The dashboard is expected to read the complete OpenClaw configuration directly from the user's home directory. The audited package does not define a redacted data interface, constrain which fields the dashboard may read, or provide a sandbox that limits filesystem and network access. This exposure is particularly dangerous when combined with the unpinned remote execution channel: the code receiving access to the configuration can change whenever the remote `main` branch or its dependencies change. The audited Markdown files contain no direct command that uploads `openclaw.json`, so actual credential exfiltration is not confirmed. Nevertheless, giving mutable, unaudited code direct access to a potentially sensitive configuration file creates an unnecessary trust boundary and fails least-privilege design. ### Attack Path 1. The Skill downloads or updates the dashboard from the mutable remote branch. 2. The dashboard or one of its dependencies is modified maliciously or compromised. 3. The Skill executes the dashboard under the user's account. 4. The dashboard reads `~/.openclaw/openclaw.json` as explicitly intended. 5. Malicious runtime code extracts any credentials, provider settings, model configuration, agent metadata, or other sensitive fields present in the file. 6. Because the runtime is not sandboxed, it can use ordinary network APIs to transmit coll ...[truncated 819 chars]
• Remediation: ## Remediation Suggestions 1. Do not give the dashboard direct access to the complete configuration file. 2. Introduce a trusted local adapter that parses the configuration and returns only fields required for display. 3. Remove or mask API keys, tokens, passwords, cookies, private endpoints, and other secret-bearing fields before data reaches the dashboard. 4. Provide the dashboard with a generated read-only snapshot rather than the original file. 5. Run the dashboard in a sandbox that cannot read the user's home directory except for the sanitized input. 6. Bind the server to `127.0.0.1` by default. Require explicit informed approval before exposing it on a LAN interface. 7. Apply a restrictive content security policy and disable unnecessary outbound network access. 8. Pin, verify, and audit the dashboard code and dependencies before granting any configuration access. 9. Document precisely which configuration fields are read, retained, displayed, logged, or transmitted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- Remove old project directory:
  ```bash
  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"

• Confidence: 96% confidence
• Finding: The explicit command `rm -rf ~/projects/OpenClaw-bot-review` is a true destructive operation and not a false positive in this context. Because the skill is designed for autonomous execution, embedding a forced delete path materially raises the risk of accidental or repeated data loss, especially if the directory contains local modifications or if path assumptions are wrong.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- Remove old project directory:
  ```bash
  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"

• Confidence: 96% confidence
• Finding: The explicit command `rm -rf ~/projects/OpenClaw-bot-review` is a true destructive operation and not a false positive in this context. Because the skill is designed for autonomous execution, embedding a forced delete path materially raises the risk of accidental or repeated data loss, especially if the directory contains local modifications or if path assumptions are wrong.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README instructs users to run `npx clawhub install openclaw-bot-dashboard` without pinning a specific package version. `npx` resolves and executes the latest published package by default, which creates a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed; this is more concerning here because the skill also automates downloading code, installing dependencies, and starting services.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README also recommends `npx skills add xmanrui/openclaw-bot-dashboard` without a pinned version for the `skills` package. This exposes users to the same remote code execution and supply-chain risk from whatever package version is current at execution time, and the danger is amplified because the installed skill performs OS detection, dependency installation, update pulls, and background process management.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase set includes broad natural-language commands such as `open bot review`, `launch bot review`, and `start dashboard`, which can plausibly occur in ordinary conversation. In an agent environment, overly broad triggers can cause unintended activation of a skill that stops services, downloads code, runs `npm install`, and launches a background web server, turning accidental invocation into a meaningful security and safety issue.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes destructive and system-affecting behavior including stopping an existing service, pulling or re-downloading code, installing dependencies, and starting a background process, but it does not present a clear up-front warning or ask for explicit user consent. This is dangerous because users may invoke what appears to be a simple dashboard opener while actually authorizing process termination, filesystem changes, network downloads, and execution of newly fetched code.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The metadata description advertises broad trigger phrases including "open bot dashboard" and "open bot review," which are not sufficiently scoped to this specific skill. In context, broad activation is dangerous because invocation causes command execution, package installation, process termination, and repository download without further validation.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation list includes generic phrases like "open bot review," "launch bot review," and "start dashboard," which can plausibly occur in normal conversation and trigger the skill unexpectedly. Because this skill performs side-effectful actions such as killing processes, downloading code, installing dependencies, and starting services, accidental invocation increases the risk of unintended local system changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly instructs the agent to kill whatever is listening on port 3000 and, in some branches, delete the existing project directory, all without a clear up-front user warning or confirmation. These are destructive side effects that can terminate unrelated applications, remove local data, and disrupt ongoing work if the port or directory is being used for something else.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The required return formats are fully specified in Chinese and use imperative language such as "You MUST return both" and fixed Chinese response templates. This forces a specific language for the user-facing output without opt-in, even though the skill otherwise mentions i18n support.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list contains generic phrases such as "start dashboard", "open bot review", and "openclaw dashboard" that may match ordinary user requests outside a clearly scoped invocation. This can cause unintended activation of a skill that launches or manages local services, increasing the risk of surprise execution, dependency installation, or network activity without explicit user intent.

Scope Creep

Low

• Category: Excessive Agency

Content

- "launch bot review"
- "start dashboard"

The skill will automatically handle everything and give you the access URL!

## 🌟 Features

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill states that it reads the local OpenClaw configuration file directly but does not provide an up-front privacy notice or explain what data may be exposed through the dashboard. Since configuration files often contain tokens, endpoints, model settings, or session metadata, silently accessing them can create privacy and credential exposure risk.

Static analysis

No suspicious patterns detected.