OpenClaw Dashboard Connector - ClawHQ

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:38 PM UTC
• Version: 1.0.1

Overview

This skill is a straightforward dashboard connector that reports agent status to ClawHQ, with disclosed outbound telemetry that users should treat as potentially sensitive.

Install only if you are comfortable sending agent names, statuses, task descriptions, and heartbeat information to ClawHQ. Use a dedicated API key, store it as a protected environment variable, avoid putting secrets or client-confidential details in task summaries, and revoke or rotate the key if exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to send status and the current task summary to an external SaaS endpoint, but the description does not prominently warn the user that operational data will leave the local environment. Task summaries can easily contain sensitive client data, secrets, filenames, incident details, or proprietary work context, so silent exfiltration to a third party creates a meaningful privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Mac/Linux (curl):**
```bash
curl -s -X POST "https://app.clawhq.co/api/agents/report" \
  -H "Authorization: Bearer $CLAWHQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent":"<agent_name>","status":"working","task":"<current task summary>"}'

• Confidence: 97% confidence
• Finding: This command sends the agent name, status, and current task summary to an external service over the network using a bearer token. Even if intended for observability, the transmitted task summary may contain sensitive internal data, and the skill encourages routine automatic exfiltration of that content to a third-party endpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Mac/Linux:**
```bash
curl -s -X POST "https://app.clawhq.co/api/agents/report" \
  -H "Authorization: Bearer $CLAWHQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent":"<agent_name>","status":"idle"}'

• Confidence: 84% confidence
• Finding: This command transmits agent metadata and status to an external service, which is still an external data flow even though it omits the task summary. The sensitivity is lower than the session-start report, but it still discloses operational telemetry and normalizes unaudited outbound communications to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Verify Connection

```bash
curl -X POST "https://app.clawhq.co/api/agents/report" \
  -H "Authorization: Bearer $CLAWHQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent":"test","status":"idle"}'

• Confidence: 90% confidence
• Finding: The verification command explicitly performs an authenticated POST request to an external endpoint using a bearer token from an environment variable. While this may be legitimate product behavior, it is still a real external transmission path that exposes agent-identifying metadata and normalizes sending credentials to a remote service without contextual safeguards or minimization guidance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup instructions direct users to send agent status data and an API bearer token to a third-party remote service, but they do not disclose privacy, data handling, retention, or security implications. Even though this appears to be the intended functionality of the dashboard integration, the lack of warning or consent context can cause users to transmit operational metadata to an external service without understanding the exposure.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill requires a persistent API key but does not include handling guidance about secure storage, least privilege, rotation, or avoiding accidental disclosure in logs and prompts. While the example does not directly print the key, normalizing credential use without safety guidance increases the chance of mishandling and unauthorized access to the reporting account.

Static analysis

No suspicious patterns detected.