Security audit

Web Dashboard Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This is a dashboard template, but it needs review because its sample server and helper scripts can expose monitoring data and keep a local service running without enough safeguards.

Review and harden the generated code before using it with real monitoring data. Bind the server to 127.0.0.1 unless intentionally exposing it, remove wildcard CORS, add authentication for sensitive data, avoid innerHTML for untrusted content, use a private runtime directory, and do not run the documented kill -9 port command unless you have verified the target process.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:262
Finding: DOM-based cross-site scripting through unsafe modal content rendering
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:344
Finding: Unauthenticated dashboard API exposed on network interfaces with wildcard CORS
Content: View full analysis
{ // CORS res.setHeader('Access-Control-Allow-Origin', '*'); if (req.url === '/' || req.url === '/index.html') { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(html); return; } if (req.url === '/api/data') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(getData())); return; } res.writeHead(404); res.end('Not Found'); }); server.listen(PORT, () => { console.log(`📊 监控面板已启动`); console.log(` 访问地址：http://localhost:${PORT}`); console.log(` API: http://localhost:${PORT}/api/data`); }); ``` ### Technical Analysis The server does not implement authentication or authorization for either the dashboard or `/api/data`. Calling `server.listen(PORT)` without specifying a host generally binds Node.js to an unspecified address, making the service available through non-loopback interfaces where network policy permits it. The response additionally sets `Access-Control-Allow-Origin: *`, allowing scripts hosted by any origin to read the API response when they can reach the service. Although the example data is synthetic, the Skill explicitly instructs users to replace `getData()` with database, API, or file-backed data. That customization can turn the endpoint into an unauthenticated information-disclosure interface. Wildcard CORS is not the cause of direct network reachability, but it expands exposure by allowing an arbitrary website loaded in a victim's browser to read responses from the dashboard. ### Attack Path 1. A user follows the Skill and replaces `getData()` with monitoring information from a database, API, or local file. 2. The server is launched wi ...[truncated 1108 chars]
Remediation: View remediation
{ console.log(`Dashboard available at http://127.0.0.1:${PORT}`); }); ``` - Require explicit configuration before exposing the service on external interfaces. - Add authentication and server-side authorization before returning monitoring data. - Replace wildcard CORS with a strict allowlist of trusted origins, or omit CORS entirely when cross-origin access is unnecessary. - Place remotely accessible deployments behind a hardened reverse proxy that provides TLS, authentication, request limits, and security headers. - Avoid returning secrets, credentials, or unrestricted file contents through `getData()`. - Document firewall requirements and make clear that logging a `localhost` URL does not ensure loopback-only binding. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:379
Finding: Predictable shared temporary files permit symlink and PID-file manipulation
Content: View full analysis
/dev/null 2>&1; then echo "✅ 监控面板已在运行 (PID: $PID)" exit 0 fi fi # Start service with automatic restart echo "🚀 启动监控面板..." cd "$SCRIPT_DIR" ( while true; do node server.js >> "$LOG_FILE" 2>&1 echo "⚠️ 服务意外停止，5 秒后重启..." >> "$LOG_FILE" sleep 5 done ) > /dev/null 2>&1 & echo $! > "$PID_FILE" sleep 3 if ps -p $(cat "$PID_FILE") > /dev/null 2>&1; then echo "✅ 监控面板已启动" echo " 访问地址：http://localhost:18790" echo " 日志文件：$LOG_FILE" echo " 进程 PID: $(cat $PID_FILE)" ``` ### Technical Analysis The startup script stores logs and process state in the fixed, predictable directory `/tmp/openclaw-monitor`. Shared temporary directories are commonly writable by multiple local users. The script does not verify the directory's owner or permissions and does not protect the log and PID files against symbolic links. Shell redirection to `"$LOG_FILE"` and `"$PID_FILE"` follows symbolic links. If the script is run under a more privileged account than an attacker, a pre-created symlink may redirect writes to another file writable by that account. The script also trusts PID-file contents and supplies them to `ps` without validating that the value is a single positive integer. This can permit local denial of service, unreliable process detection, or option-like input being interpreted by the invoked command. ### Attack Path 1. A local attacker predicts that another user or administrator will run the dashboard script. 2. Before startup, the attac ...[truncated 1203 chars]
Remediation: View remediation
&2 exit 1 fi ``` - Quote all PID expansions and use an option terminator where supported. - Verify that a PID belongs to the expected dashboard process rather than treating any existing PID as authoritative. - Prefer a supervised service manager with a protected runtime directory and native restart policy instead of a custom PID file. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:522
Finding: Troubleshooting instructions forcibly terminate every process using the configured port
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README instructs users to run lsof -ti:18790 | xargs kill -9, which forcefully terminates whatever process is bound to that port without warning, confirmation, or guidance on verifying ownership. In a skill intended for local monitoring/dashboard use, readers may copy-paste the command and unintentionally kill unrelated services, causing local denial of service or data loss if the process was not this dashboard.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The troubleshooting step lsof -ti:18790 | xargs kill -9 forcefully terminates any process bound to port 18790 without confirming ownership, graceful shutdown, or warning about side effects. In a shared or repurposed environment, this can kill unrelated services and may cause data loss or corruption because kill -9 bypasses cleanup handlers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation is written entirely in Chinese, including usage instructions and safety-relevant operational guidance, with no indication that this is a China-specific or Chinese-only skill. That imposes a language choice on users without opt-in or justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document presents all user-facing instructions in Chinese and the sample page sets lang="zh-CN", which imposes a specific language/locale by default. There is no indication that users may choose another language or that the locale is intentionally limited to a region-specific use case.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This is a manifest file, so vague-trigger review applies. The description lists general capabilities like "Web dashboard optimization best practices" and "auto-restart service" but does not define when the skill should be invoked, what requests should trigger it, or any exclusions, making invocation scope ambiguous.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.