InfoDashboard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:04 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate setup guide, but it sends users through a high-trust install path that runs unpinned remote code, a tunnel binary, Docker, and database credentials.

Install only if you trust the upstream InfoDashboard repository and are willing to run its current code and bundled tunnel binary on your machine. Before using it, pin and review a specific commit, verify frpc provenance or checksums, use a least-privilege database account, keep secrets out of chat, avoid exposing the service publicly unless protected, and run it in a constrained environment where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/clone.md:26

Finding

Unpinned Remote Repository and Unverified Bundled Binary Execution

Content

View full analysis

Remediation

View remediation

test "$(git rev-parse HEAD)" = "" ``` 3. Verify signed tags or commits against an explicitly trusted maintainer key. 4. Publish and verify SHA-256 checksums and signatures for `frpc.exe` and `frpc-linux` before execution. 5. Prefer installing `frpc` from a trusted, version-pinned package source or building it reproducibly from a reviewed upstream release. 6. Pin all Python dependencies with hashes in a lock file. Review direct and transitive dependencies before installation. 7. Avoid editable installation for production use. Build a reviewed wheel in an isolated environment and install the verified artifact. 8. Run installation and startup under a dedicated, unprivileged account or a sandboxed container with minimal filesystem and network access. 9. Do not mount privileged Docker sockets or unrelated host directories into the service environment. 10. Restrict `.env.local` and `frpc-visitor.ini` permissions to the service account and ensure they are excluded from version control and logs. 11. Grant the configured database account only the minimum read or write permissions required for dashboard generation. 12. Restrict tunnel destinations and outbound network access to explicitly required hosts and ports. 13. Bind the FastAPI service to `127.0.0.1` by default unless remote exposure is explicitly required and protected by authentication, TLS, and firewall rules. 14. Add a mandatory integrity-verification step before `pip install`, `python main.py`, or automatic tunnel startup. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 22)May include surrounding context.

Setup Procedure

bash

cp .env.example .env.local

Then edit .env.local with the values below.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- InfoDashboard generation uses server-side provider config, not the OpenClaw agent's own model or API key.
- This skill must not rely on any request-time model or provider overrides.
- Only server-side config files (`.env.local`) may control LLM provider selection.
- Do not ask the user to paste API keys or database passwords into chat.
- Prefer guiding the user to edit `.env.local` themselves.
- Do not offer to write secrets into config files on the user's behalf.
- Once setup is complete and the user clearly asks to generate a dashboard, do not ask for a second confirmation before submitting the generation request.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

- Only server-side config files (`.env.local`) may control LLM provider selection.
- Do not ask the user to paste API keys or database passwords into chat.
- Prefer guiding the user to edit `.env.local` themselves.
- Do not offer to write secrets into config files on the user's behalf.
- Once setup is complete and the user clearly asks to generate a dashboard, do not ask for a second confirmation before submitting the generation request.

## Optional Skill Config

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config.md (reported line 42)May include surrounding context.

env

OPENAI_API_KEY=sk-...
OPENAI_BASE_URL=https://api.openai.com/v1   # omit for official OpenAI
DEFAULT_MODEL=gpt-4o

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The flow explicitly allows immediate submission of a generation request that causes backend schema access, LLM-driven code generation, and Docker deployment, but it does not require any user-facing disclosure at the moment of execution. In this skill context, those actions are state-changing and potentially sensitive, so skipping an explicit warning increases the risk of users authorizing impactful operations without understanding the security and privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file includes natural-language examples and agent status text in Chinese, such as the sample user_request and the thinking example, but does not state that language is configurable or user-selected. This can create a locale/language policy issue if the skill implicitly assumes Chinese output or interaction without user opt-in.

Content

No source excerpt is available for this finding.