# Security Audit Report

**Score:** 0/100  
**Skill Name:** openclaw-dashboard-repo  
**Risk Level:** High Risk  
**Author:** vivekchand  
**Files Audited:** 91  
**Audit Date:** 4/30/2026, 1:13:25 PM

🔭 Continuously monitored by ClawSecure Watchtower

**Findings:** 27  
- **Critical:** 0  
- **High:** 25  
- **Medium:** 2  
- **Low:** 0  
- **Info:** 0

**Source:** [openclaw-dashboard-repo](https://github.com/vivekchand/clawmetry)

**SHA-256:** adf2859996e2...

openclaw-dashboard-repo is an Other skill for the OpenClaw ecosystem, created by vivekchand. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 0/100, indicating significant security concerns that require attention. The audit identified 27 findings, with issues detected across multiple security layers.

## 3-Layer Audit Protocol

### 🛡 ClawSecure Proprietary Engine  
- **Findings:** 27  
- **Critical Issues Found:** Missing config.json - agent may not be properly configured, Attempts to access sensitive file: MEMORY.md, Attempts to access sensitive file: SOUL.md +5 more

### 🔒 Advanced Static & Behavioral Analysis  
- **Findings:** 0  
- **Status:** PASS

### 📦 Supply Chain Security  
- **Findings:** 0  
- **Status:** PASS

### HIGH Severity Findings — 25 total
- **F-001:** Attempts to access sensitive file: MEMORY.md
   - **Category:** ASI06OWASP ASI: Memory & Context Poisoning
- **F-002:** Attempts to access sensitive file: SOUL.md
   - **Category:** ASI06OWASP ASI: Memory & Context Poisoning
- More findings documented similarly...

### MEDIUM Severity Findings — 2 total
- **F-001:** Missing config.json - agent may not be properly configured
   - **Category:** ASI03OWASP ASI: Identity & Privilege Abuse
- **F-002:** ReDoS vulnerability: Nested quantifiers
   - **Category:** ASI05OWASP ASI: Unexpected Code Execution

## OWASP ASI Framework Coverage
- ASI01: Agent Goal Hijack
- ASI02: Tool Misuse
- ASI03: Identity & Privilege
- ASI04: Agentic Supply Chain
- ASI05: Unexpected Code Execution
- ASI06: Memory & Context
- ASI07: Insecure Inter-Agent Communication
- ASI08: Cascading Failures
- ASI09: Human-Agent Trust Exploitation
- ASI10: Rogue Agents

## Security Recommendations for openclaw-dashboard-repo
1. **Pin npm dependencies to exact versions.** Unpinned dependencies allow supply chain attacks. Use exact version numbers in package.json (e.g., `1.2.3` instead of `^1.2.3`).
2. **Add a config.json permissions manifest.** This file declares what permissions your OpenClaw skill needs, documenting any actions that occur upon installation.

## Context-Aware Analysis
This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities within the ecosystem context, differentiating real threats from normal agent functionality.

### Findings tagged with OWASP ASI Top 10 category references where applicable. ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories.