Pixel Office

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This skill needs review because it presents as a pixel-office UI but automatically downloads and runs an external OpenClaw dashboard with local config access and process-control side effects.

Install only if you trust the publisher and the live GitHub repository it downloads from. Before using it, understand that it can run npm install and npm run dev from mutable remote code, stop anything already using port 3000, remove its project directory during updates, read your OpenClaw configuration, and advertise a LAN dashboard URL. Prefer a pinned, reviewed source revision with explicit confirmation before download, update, process termination, config access, or LAN exposure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:72

Finding

Automatic Retrieval and Execution of Mutable Remote Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:72-103, SKILL.md:133-212, SKILL.md:357-365
Vulnerability Type: Mutable remote payload retrieval followed by dependency installation and execution
Risk Level: Critical

Vulnerable Code

bash

# SKILL.md:72-103
cd ~/projects/OpenClaw-bot-review
git fetch origin main 2>/dev/null
LOCAL=$(git rev-parse HEAD 2>/dev/null)
REMOTE=$(git rev-parse origin/main 2>/dev/null)

if [ "$LOCAL" != "$REMOTE" ]; then
  echo "update_available"
else
  echo "up_to_date"
fi

text

If update available:
- Inform user: "检测到新版本，正在更新..."
- Pull latest code: `git pull origin main`
- Reinstall dependencies: `npm install`
- Continue to Step 5 (start service)

bash

# SKILL.md:133-160
# macOS/Linux
mkdir -p ~/projects
cd ~/projects
git clone https://github.com/xmanrui/OpenClaw-bot-review.git

# Windows (PowerShell)
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\projects"
cd "$env:USERPROFILE\projects"
git clone https://github.com/xmanrui/OpenClaw-bot-review.git

bash

mkdir -p ~/projects
cd ~/projects
curl -L https://github.com/xmanrui/OpenClaw-bot-review/archive/refs/heads/main.zip -o openclaw-dashboard.zip
unzip openclaw-dashboard.zip
mv OpenClaw-bot-review-main OpenClaw-bot-review
rm openclaw-dashboard.zip

powershell

New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\projects"
cd "$env:USERPROFILE\projects"
Invoke-WebRequest -Uri "https://github.com/xmanrui/OpenClaw-bot-review/archive/refs/heads/main.zip" -OutFile "openclaw-dashboard.zip"
Expand-Archive -Path "openclaw-dashboard.zip" -DestinationPath "."
Rename-Item -Path "OpenClaw-bot-review-main" -NewName "OpenClaw-bot-review"
Remove-Item "openclaw-dashboard.zip"

bash

# SKILL.md:183-212
cd ~/projects/OpenClaw-bot-review
npm install

cd ~/projects/OpenClaw-bot-review
npm run dev > /dev/null 2
...[truncated 2228 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the reviewed dashboard implementation with the Skill instead of retrieving executable code at runtime.
2. If remote retrieval is unavoidable, pin an immutable Git commit rather than main.
3. Publish and verify a trusted SHA-256 digest or cryptographic signature before extraction or execution.
4. Commit and enforce a reviewed lockfile, and use npm ci rather than unconstrained npm install.
5. Use npm ci --ignore-scripts unless lifecycle scripts have been individually audited and are strictly required.
6. Display the source revision and request explicit user approval before downloading, updating, installing dependencies, or executing code.
7. Run the dashboard in a sandbox with read-only filesystem access, restricted network access, and access only to explicitly required configuration fields.
8. Do not automatically update previously reviewed installations to an unreviewed upstream revision.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:39

Finding

Forced Termination of Arbitrary Processes Using Port 3000

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-70, SKILL.md:292-308
Vulnerability Type: Destructive process control without ownership verification
Risk Level: High

Vulnerable Code

bash

# Check if process is already running on port 3000
lsof -ti:3000

bash

lsof -ti:3000 | xargs kill -9 2>/dev/null
echo "已停止旧服务"

powershell

Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess | Stop-Process -Force
Write-Host "已停止旧服务"

cmd

for /f "tokens=5" %a in ('netstat -ano ^| findstr :3000') do taskkill /F /PID %a
echo 已停止旧服务

The same force-termination instructions are repeated in SKILL.md:292-308 for stopping the server.

Technical Analysis

Process identity is determined solely from ownership of TCP port 3000. The Skill does not verify that the selected PID belongs to the Pixel Office dashboard, was launched by this Skill, has the expected executable or working directory, or is safe to terminate.

On Unix-like systems, kill -9 prevents graceful cleanup. On Windows, Stop-Process -Force and taskkill /F have similar destructive behavior. The startup workflow therefore grants the Skill control over unrelated applications and uses that control automatically, even though selecting another available port would satisfy the declared functionality.

Attack Path

1. An unrelated development server, administrative interface, or local application legitimately listens on port 3000.
2. The user invokes the Pixel Office Skill.
3. The Skill obtains the PID associated with port 3000 without validating process ownership or identity.
4. It force-terminates that PID.
5. The unrelated service becomes unavailable and may lose unsaved or partially written state.
6. Pixel Office subsequently claims the released port.

Impact Assessment

The direct impact is denial of service against any process using port 3000. Forced termination may cause l ...[truncated 286 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the PID of the dashboard process in a dedicated PID file when launching it.
2. Before termination, verify the PID, executable, command line, working directory, and process owner.
3. If port 3000 is occupied by an unrecognized process, do not terminate it automatically; select another available port or ask the user for confirmation.
4. Attempt a graceful shutdown first and use forced termination only after a timeout.
5. Avoid broad port-based process selection where multiple matching connections could produce unintended PIDs.
6. Never request elevated privileges merely to terminate a process occupying the preferred port.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:235

Finding

Sensitive OpenClaw Configuration Is Entrusted to Remotely Sourced Code and Potentially Exposed over LAN

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:235-280, SKILL.md:319-324; related documentation at README.md:85-90, README.md:114-119
Vulnerability Type: Unsafe configuration trust boundary and network exposure
Risk Level: High

Vulnerable Code

text

You MUST return both:
- Local URL
- LAN URL

First, actually detect the machine's LAN IPv4 address. Do not guess it.

bash

# macOS/Linux
(ipconfig getifaddr en0 || ipconfig getifaddr en1 || hostname -I | awk '{print $1}') 2>/dev/null

powershell

(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias "Ethernet*","Wi-Fi*" | Select-Object -First 1).IPAddress

text

Rules:
- You MUST execute an IP detection command before composing the final reply.
- Do NOT guess or fabricate the LAN IP.
- Do NOT omit the LAN URL just because localhost works.
- You MUST include both the local URL and the LAN URL in the final reply.

text

- Dashboard reads config directly from `~/.openclaw/openclaw.json` - no database needed

Related README statements include:

text

- OpenClaw installed with config at `~/.openclaw/openclaw.json`

text

The dashboard reads from `~/.openclaw/openclaw.json`. Make sure OpenClaw is properly installed.

Technical Analysis

The dashboard is expected to read ~/.openclaw/openclaw.json, while the dashboard implementation itself is not included in the audited package and is instead downloaded from a mutable remote repository. This places potentially sensitive provider, model, platform, and operational configuration inside the trust boundary of unreviewed remote code.

The Skill also mandates presentation of a LAN URL. The audited files do not establish the development server's exact bind address, authentication controls, or whether configuration secrets are redacted before display. Therefore, direct external exfiltration is not proven by the supplied files. Never ...[truncated 1743 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind the dashboard to 127.0.0.1 by default.
2. Make LAN exposure an explicit, informed opt-in rather than a mandatory behavior.
3. Require authentication and authorization before serving any dashboard data over a network interface.
4. Read only the minimum required configuration fields through a constrained interface instead of granting the dashboard access to the complete file.
5. Remove or redact API keys, tokens, credentials, session content, and other secrets before rendering responses.
6. Apply restrictive filesystem permissions and sandbox the dashboard process.
7. Audit the actual downloaded dashboard source for outbound requests, bind settings, API endpoints, directory traversal, and secret handling before use.
8. Clearly disclose which configuration fields are read and whether any data leaves the local machine.

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Unpinned npx Installers Can Download and Execute Mutable Packages

Content

View full analysis

Vulnerability Details

File Location: README.md:20-29
Vulnerability Type: Unpinned package installer execution
Risk Level: Medium

Vulnerable Code

bash

# From ClawHub
npx clawhub install openclaw-bot-dashboard

bash

# From skills.sh
npx skills add xmanrui/openclaw-bot-dashboard

Technical Analysis

The documented npx commands do not pin exact versions or integrity values. If the relevant command-line package is not already installed locally, npx may retrieve and execute its current registry version. The effective installer can therefore change after this repository has been audited.

The commands subsequently install another Skill from an external source, creating an additional supply-chain boundary. No checksum, signature, immutable revision, or trusted package version is specified.

Attack Path

1. An attacker compromises the package publisher, registry account, distribution infrastructure, or a dependency.
2. A malicious version is published under the package name used by the unpinned npx command.
3. A user follows the README installation instructions.
4. npx downloads and executes the current package version.
5. The malicious installer runs with the user's permissions and can modify the Skill installation or other accessible files.

Impact Assessment

Exploitation can result in arbitrary code execution with the installing user's privileges. The malicious installer may access credentials, alter OpenClaw skills or configuration, install additional packages, or persist modifications within user-writable locations. The exposure applies primarily to users following these optional README installation instructions.

Remediation

View remediation

Remediation Suggestions

1. Pin the command-line packages to exact reviewed versions.
2. Publish and verify package integrity hashes or signatures.
3. Prefer a locally installed, reviewed package manager client over ephemeral npx execution.
4. Pin the installed Skill to an immutable release or commit.
5. Document the package publisher, expected digest, and verification procedure.
6. Run installation in a restricted environment and require confirmation before filesystem or configuration changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The declared skill metadata says this is a pixel-art office visualization, but the README describes a much broader capability: downloading external code, installing dependencies, updating code, killing services, and launching a development server. This mismatch is dangerous because it can mislead users and reviewers about the true operational scope, reducing informed consent for high-impact actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented behavior includes cloning/downloading remote code, running npm install, and starting a background dev server, none of which are necessary for a simple pixel-office visualization as described in the metadata. This unjustified capability expansion materially increases the attack surface by enabling arbitrary dependency execution and persistent local services under a misleading feature banner.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises a harmless pixel-art office UI, but its documented behavior clones and runs a separate OpenClaw dashboard with broader monitoring capabilities. This mismatch is dangerous because users may consent to a cosmetic visualization while the skill actually downloads external code, installs packages, and launches software with access to local agent and session data.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill instructs recursive forced deletion of the project directory as part of normal update behavior when git is unavailable. Even though the path is narrower than the home directory, this is still dangerous because path mistakes, symlink abuse, or local modifications can lead to loss of files and destructive behavior without user approval.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

• Remove old project directory:

  bash

  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"
  

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill instructs recursive forced deletion of the project directory as part of normal update behavior when git is unavailable. Even though the path is narrower than the home directory, this is still dangerous because path mistakes, symlink abuse, or local modifications can lead to loss of files and destructive behavior without user approval.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

• Remove old project directory:

  bash

  # macOS/Linux
  rm -rf ~/projects/OpenClaw-bot-review
  
  # Windows (PowerShell)
  Remove-Item -Recurse -Force "$env:USERPROFILE\projects\OpenClaw-bot-review"
  

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The return messaging presents the service as Pixel Office while the implementation actually launches an OpenClaw dashboard that reads configuration and exposes robot, model, and session status. This deceptive framing increases the chance that users will unknowingly expose internal operational data through a service they believe is only a visual UI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises automatic cloning, updates, dependency installation, stopping old services, and launching a dev server, but does not present a clear upfront warning that these actions modify the system and may terminate existing processes. Users may therefore consent to a seemingly harmless visualization skill without understanding the operational side effects.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The README instructs users to execute npx clawhub install openclaw-bot-dashboard without pinning a specific package version. This can cause users to fetch and run whatever package version is current at execution time, increasing supply-chain risk if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The README recommends npx skills add xmanrui/openclaw-bot-dashboard without pinning a version or immutable reference. That means installation behavior can change over time and may expose users to unreviewed or compromised upstream content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger phrases such as 'start dashboard' or 'open bot review' may be activated during ordinary conversation, causing unintended execution of a skill that performs network downloads, dependency installation, service termination, and background process startup. Because the skill's actions are system-affecting, accidental invocation has meaningful security and safety consequences.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill performs network retrieval of code from GitHub despite presenting itself as a local pixel-office UI. Downloading and executing remote code materially changes the trust boundary and can expose users to supply-chain compromise or unexpected installation of unreviewed software.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automatically downloads code from the internet, installs dependencies, and starts a background server without making those actions sufficiently prominent in the user-facing description. This undermines informed consent and increases exposure to supply-chain risks and unwanted long-running local services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it reads the user's OpenClaw configuration file even though that access is not clearly required by the advertised pixel-office feature. Reading local configuration may expose sensitive endpoints, tokens, model settings, or session metadata beyond what the user expects from a visual office interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation notes that the dashboard reads the user's OpenClaw configuration file, but it does not provide a clear privacy warning about the sensitivity of that data. Users may not realize that local configuration can contain information about models, endpoints, or operational state that should be treated as sensitive.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions forcefully kill any process bound to port 3000 without verifying ownership or whether it belongs to the intended application. This broad operational control can terminate unrelated services, causing denial of service or data loss if the killed process was performing legitimate work.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow includes destructive actions such as force-killing processes and deleting the project directory, but it does not provide adequate upfront warning or require confirmation. Users may lose work, interrupt unrelated local services, or remove locally modified files without understanding that these actions will occur automatically.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

md

- "launch bot review"
- "start dashboard"

The skill will automatically handle everything and give you the access URL!

## 🌟 Features

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions require a specific final reply format entirely in Chinese, including mandatory Chinese status/error text. This imposes a fixed language on the interaction without giving the user a language preference or opt-in, which matches the locale/language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.