ClawHub
Back to skill

Security audit

OpenClaw Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw monitoring dashboard that reads local status data and can format Feishu status cards, but users should review the metadata it shares and the optional web dashboard's security hygiene.

Install only if you are comfortable with an OpenClaw status tool showing operational metadata such as token usage, active session labels, node/channel, model, OS, and runtime. Use Feishu card output only in trusted chats, and treat the optional web dashboard as needing hardening before exposing it beyond a local trusted environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
dashboard.html:773
Finding

DOM-Based Cross-Site Scripting Through Unescaped Dashboard API Fields

Content
View full analysis
${data.model || '-'}`; document.getElementById('channel').innerHTML = `${data.channel || '-'}`; // System status document.getElementById('node').textContent = data.node || '-'; document.getElementById('uptime').textContent = data.uptime || '-'; document.getElementById('os').textContent = data.os || '-'; document.getElementById('runtime').innerHTML = `${data.runtime || '-'}`; document.getElementById('nodeId').innerHTML = `${data.node || '-'}`; // Sessions const sessionCount = data.sessionCount || 0; document.getElementById('sessionCount').textContent = `${sessionCount} active`; document.getElementById('activeSessions').textContent = sessionCount; // Session list const sessionList = document.getElementById('sessionList'); if (data.sessions && data.sessions.length > 0) { sessionList.innerHTML = data.sessions.map(session => `
${escapeHtml(session.label || session.id)} ${session.kind || 'agent'}
${session.messageCount || 0} messages
${session.activeMinutes || 0}m
Active time
`).join(''); } ``` ### Technical Analysis The dashboard obtains data from the same-origin `/api/dashboard/data` endpoint and passes several response fields directly into `innerHTML`. The affected fields include `model`, `channel`, `runtime`, `n ...[truncated 1932 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
dashboard.html:9
Finding

Third-Party Executable JavaScript Loaded Without Subresource Integrity

Content
View full analysis
``` ### Technical Analysis The dashboard loads and executes Chart.js directly from the jsDelivr CDN. The dependency version is pinned to `4.4.1`, which limits unintended version changes, but the script element does not specify a Subresource Integrity hash. Consequently, the browser trusts whatever executable content is returned for that URL at page-load time. A compromise of the CDN, package distribution path, or served asset could cause modified JavaScript to execute with the same browser privileges as the dashboard itself. This external request also conflicts with the README's broad assertion that there are no external API calls. While the request is for a static dependency rather than a data API, it remains an external network dependency that should be disclosed. ### Attack Path 1. A user opens the dashboard while external network access is available. 2. The browser requests Chart.js from `cdn.jsdelivr.net`. 3. The CDN or dependency delivery path returns a maliciously modified script. 4. Because no integrity hash is present, the browser accepts and executes the response. 5. The malicious script accesses dashboard DOM content or responses from `/api/dashboard/data` and may transmit that information externally. ### Impact Assessment A malicious dependency response would execute in the dashboard page's origin and could: - Read token usage, node identifiers, runtime information, and session metadata displayed by the dashboard. - Intercept future dashboard updates. - Alter monitoring results presented to the user. - Make same-origin requests with the user's browser context. - Transmit accessible information to external servers where browser policy permits. The impact i ...[truncated 134 chars]
Remediation
View remediation
``` 3. Generate the integrity value from the exact reviewed asset rather than copying an unverified hash. 4. Enforce a restrictive Content Security Policy with an explicit `script-src` allowlist. 5. Maintain a documented dependency-update process that includes integrity-hash updates and security review. 6. Update the security documentation to disclose the external Chart.js and Google Fonts network dependencies. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · dashboard.html (reported line 8)May include surrounding context.

html
<meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>OpenClaw Dashboard</title>
  
  <!-- Chart.js -->
  <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
  
  <!-- Inter 字体 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · dashboard.html (reported line 494)May include surrounding context.

html
</div>
    </header>

    <!-- 加载状态 -->
    <div id="loading" class="loading">
      <div class="loading-spinner"></div>
      <span>正在加载数据...</span>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · dashboard.html (reported line 578)May include surrounding context.

html
</div>
        </div>

        <!-- Sessions -->
        <div class="card">
          <div class="card-header">
            <div class="card-title">

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The top-level description is written entirely in Chinese and the document does not indicate that other languages are supported or that Chinese is required for a region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly advertises pushing status cards to Feishu group chats, and the surrounding description says those cards include session token consumption, agent state, and system configuration details. Sending operational metadata to an external chat platform without any warning, consent prompt, redaction guidance, or access-control discussion creates a real data-leakage risk, especially in shared group chats.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file declares lang="zh-CN", and the UI text and date/time formatting are consistently hard-coded to Chinese. The policy specifically calls for flagging language or locale constraints when they are forced without user opt-in or an explicit documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code uses toLocaleString('zh-CN'), which forces Chinese locale formatting regardless of user preference. This is a natural-language/locale policy issue because the skill does not offer a choice or indicate that the locale restriction is region-specific and intentional.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The UI inserts several dashboard fields from fetched data using innerHTML, such as model, channel, runtime, and nodeId, while only session labels are explicitly escaped. If the /api/dashboard/data endpoint or any upstream metadata source is attacker-controlled or compromised, this can lead to DOM-based XSS in the dashboard context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

With no manifest available, there is no declared purpose that would justify spawning a local command. The code invokes openclaw status via execSync, which is a meaningful capability beyond simple in-process data formatting or parsing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and feature descriptions are presented in Chinese throughout the skill file, but the skill does not state that it is Chinese-only or offer users an alternative language. This can violate language/locale policy when a skill effectively forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language description is written only in Chinese ("可视化展示 OpenClaw 运行时状态"), which can indicate a language-specific skill configuration without offering a user choice or documenting that the skill is region-specific. Under the policy, locale or language constraints should be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The chart labels are produced with toLocaleTimeString('zh-CN', ...), which enforces a specific locale for displayed times. Because no locale selection or justification is provided, this violates the stated policy on forced language/locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code explicitly formats user-facing time output with the zh-CN locale, which enforces a specific language/locale choice in generated content. The same file is otherwise Chinese-language oriented, but there is no visible user choice or documented opt-in for locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The status message uses toLocaleTimeString('zh-CN'), which hardcodes a specific locale for user-facing output. This can violate language/locale policy expectations when the skill is used in broader contexts without explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code hard-codes toLocaleString('zh-CN') when rendering timestamps, which enforces a specific language/locale for all users. This matches the policy category for language or locale constraints because the file does not offer user opt-in or explain why a China-specific locale is required.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/collector.js:22