Portal

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:57 AM UTC
• Version: 1.4.0

Overview

This skill appears purpose-built for creating hosted browser portals, but it asks agents to upload local projects and capture authenticated browser state without enough scoping or privacy disclosure.

Install only if you are comfortable using the portal service and plugin. Use demo or least-privilege accounts for authenticated sites, avoid production sessions, and do not upload a project root unless you have reviewed it for .env files, keys, credentials, private data, databases, and other sensitive files. Prefer a sanitized build or demo directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Plugin Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:13-14` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code**: ```sh openclaw plugins install openclaw-portal openclaw gateway restart ``` ### Technical Analysis The installation command identifies the `openclaw-portal` plugin only by name. It does not specify an audited version, integrity checksum, cryptographic signature, or explicit trusted source. Consequently, the effective plugin code can change after this Skill has been reviewed. Restarting the gateway immediately after installation causes the newly retrieved plugin to be loaded. If the package publisher, distribution registry, release process, or publisher account is compromised, a malicious release could execute with the permissions available to OpenClaw plugins. There is no evidence that the current plugin is malicious. The vulnerability is the absence of controls that bind installation to a specific reviewed artifact. ### Attack Path 1. An attacker compromises the plugin publisher, package registry, release pipeline, or another relevant distribution channel. 2. The attacker publishes a malicious or backdoored release under the expected `openclaw-portal` package name. 3. A user follows the Skill instructions and runs the unpinned installation command. 4. The package manager resolves the mutable package name to the attacker-controlled release. 5. The gateway is restarted and loads the malicious plugin. 6. The plugin executes using its granted permissions and can process Portal tool inputs or perform any other operations permitted to the plugin runtime. ### Impact Assessment Successful exploitation could provide access to information processed by the plugin, including submitted URLs, generated Portal specifications, local project archives, hosted-browser workflows, and authentication-related session references. The ultimate privilege and system ...[truncated 312 chars]
• Remediation: ## Remediation Suggestions - Pin the plugin to a specific, audited version rather than installing a mutable latest release. - Verify the package with a cryptographic checksum or trusted publisher signature. - Explicitly document the approved package registry, publisher identity, and expected artifact digest. - Require informed user approval before installing executable dependencies or restarting the gateway. - Review plugin permissions and grant only the capabilities necessary for Portal creation. - Run the plugin in a restricted sandbox with limited filesystem, credential, network, and process access. - Establish a controlled update process in which each new release is reviewed before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:85
• Finding: Local Project Archiving Can Disclose Secrets to an External Service## Vulnerability Details **File Location**: `SKILL.md:85-87` **Vulnerability Type**: Insufficiently restricted sensitive-file collection and external transmission **Risk Level**: High **Vulnerable Code**: ```text **Local file** → zip the project (exclude `node_modules`, `.git`, `dist`), base64 encode. Pass contents as `ptl.entry.source` with `entry.type: "local_file"`. ``` ### Technical Analysis The Skill instructs the Agent to archive a local project while excluding only `node_modules`, `.git`, and `dist`. This denylist does not exclude common sensitive files such as: - `.env` files and environment-specific configuration - Private keys, certificates, and signing material - Cloud-provider credentials and service-account files - Database files and backups - Authentication tokens and API keys - Local browser or session data - Deployment configuration containing secrets - Editor, build, or application caches containing sensitive values The archive is then Base64-encoded and supplied through `ptl.entry.source`. Base64 is a reversible encoding and provides no confidentiality. Because Portal launches the content in a cloud VM, the instruction creates a path by which local project contents may leave the user's machine and be processed by an external service. The file collection uses a narrow denylist rather than an allowlist of assets actually required to render the local site. A newly added or unusually named secret file can therefore be included without an explicit decision by the user. ### Attack Path 1. A local project contains credentials or other sensitive files outside the three excluded directories. 2. The user requests a Portal for the local project. 3. The Agent follows the Skill and recursively creates a project archive. 4. Sensitive files are included because they are not covered by the exclusion list. 5. The Agent Base64-encodes the archive, which does not encrypt its contents. 6. The encoded ...[truncated 996 chars]
• Remediation: ## Remediation Suggestions - Replace recursive project archiving with an allowlist containing only the static files required to run the demonstration. - Exclude secret-bearing patterns such as `.env*`, `*.pem`, `*.key`, credential files, databases, backups, session files, and cloud-provider configuration. - Perform an automated secret scan before creating or transmitting the archive. - Generate and display the final archive manifest to the user before upload. - Require explicit informed consent that identifies the external destination and the types of data being transmitted. - Abort the upload if probable credentials, private keys, tokens, or sensitive personal data are detected. - Encrypt data in transit and at rest; do not describe Base64 encoding as a security control. - Document retention periods, access controls, deletion procedures, processing regions, and subprocessors. - Prefer a dedicated export or build directory containing sanitized demonstration assets rather than the project root. - Use least-privilege test credentials and synthetic data in any local application prepared for cloud demonstration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the user to authenticate through a hosted browser and then saves authenticated state for later portal creation, but it does not require a clear privacy/security disclosure about session capture, storage, scope, retention, or third-party access. That creates risk of credential exposure, session-token misuse, or unintended sharing of sensitive application data from authenticated environments such as dashboards or admin panels.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Call `save_login` with the above. Response includes `hosted_url` — **send it to the user**
so they can open the hosted browser and log in.

Poll `get_session` until `status` is `ready`. Do NOT ask the user if they're done — the tool tells you. When ready, grab `saved_state_id`.

**Local file** → zip the project (exclude `node_modules`, `.git`, `dist`), base64 encode.
Pass contents as `ptl.entry.source` with `entry.type: "local_file"`.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to zip, base64-encode, and transmit local project contents to a remote service without requiring an explicit user consent flow or warning that repository contents will leave the local environment. This can expose proprietary source code, secrets accidentally present in files, or regulated data, especially because the instruction is framed as routine workflow rather than a sensitive data transfer.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Never guess CSS selectors** — only use what `create_script` or `pick_selectors` returns
- **Never navigate authenticated sites autonomously** — auth sites get single-page CDP grab only
- **Always show draft and get user confirmation** before `make_portal`
- **Keep polling `get_session`** — it blocks 30s server-side. Do NOT ask user if they're done
- **Pass `inner_text` on all click and scroll_to_element actions** — it's the fallback when selectors fail on dynamic pages
- **Never create a second portal while one is provisioning** — poll `get_portal` instead
- **Send URLs to the user in the chat** — do NOT run shell commands to open URLs. The user is on a messaging channel and will tap the link themselves

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.