Security Audit Report

Score: 0/100
Skill Name: openclaw-dashboard-repo
Risk Level: High Risk
Author: vivekchand
Files Audited: 91
Audit Date: 4/30/2026, 1:13:25 PM

🔭 Continuously monitored by ClawSecure Watchtower

Findings: 27

  • Critical: 0
  • High: 25
  • Medium: 2
  • Low: 0
  • Info: 0

Source: openclaw-dashboard-repo

SHA-256: adf2859996e2...

openclaw-dashboard-repo is an Other skill for the OpenClaw ecosystem, created by vivekchand. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 0/100, indicating significant security concerns that require attention. The audit identified 27 findings, with issues detected across multiple security layers.

3-Layer Audit Protocol

🛡 ClawSecure Proprietary Engine

  • Findings: 27
  • Critical Issues Found: Missing config.json - agent may not be properly configured, Attempts to access sensitive file: MEMORY.md, Attempts to access sensitive file: SOUL.md +5 more

🔒 Advanced Static & Behavioral Analysis

  • Findings: 0
  • Status: PASS

📦 Supply Chain Security

  • Findings: 0
  • Status: PASS

HIGH Severity Findings — 25 total

  • F-001: Attempts to access sensitive file: MEMORY.md
    • Category: ASI06OWASP ASI: Memory & Context Poisoning
  • F-002: Attempts to access sensitive file: SOUL.md
    • Category: ASI06OWASP ASI: Memory & Context Poisoning
  • More findings documented similarly...

MEDIUM Severity Findings — 2 total

  • F-001: Missing config.json - agent may not be properly configured
    • Category: ASI03OWASP ASI: Identity & Privilege Abuse
  • F-002: ReDoS vulnerability: Nested quantifiers
    • Category: ASI05OWASP ASI: Unexpected Code Execution

OWASP ASI Framework Coverage

  • ASI01: Agent Goal Hijack
  • ASI02: Tool Misuse
  • ASI03: Identity & Privilege
  • ASI04: Agentic Supply Chain
  • ASI05: Unexpected Code Execution
  • ASI06: Memory & Context
  • ASI07: Insecure Inter-Agent Communication
  • ASI08: Cascading Failures
  • ASI09: Human-Agent Trust Exploitation
  • ASI10: Rogue Agents

Security Recommendations for openclaw-dashboard-repo

  1. Pin npm dependencies to exact versions. Unpinned dependencies allow supply chain attacks. Use exact version numbers in package.json (e.g., 1.2.3 instead of ^1.2.3).
  2. Add a config.json permissions manifest. This file declares what permissions your OpenClaw skill needs, documenting any actions that occur upon installation.

Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities within the ecosystem context, differentiating real threats from normal agent functionality.

Findings tagged with OWASP ASI Top 10 category references where applicable. ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories.