Back to plugin

Security audit

OpenClaw Interaction Bridge v2

Security checks for vulnerabilities and agentic risk

Overview

The bridge is mostly purpose-aligned, but its default presence/environment event route can automatically wake or spawn an agent from sensor data with limited privacy and scoping guidance.

Install only if you intend Snarling or another trusted local companion to send approvals, notifications, and presence/observation events into OpenClaw. Review who has the gateway token, consider setting environmentalEventsEnabled=false or presenceTarget=disabled unless you want sensor-triggered agent turns, and treat notification/presence feedback as potentially sensitive routine data.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/openclaw-interaction-bridge/SKILL.md (reported line 41)May include surrounding context.

md
| Parameter | Type | Required | Description |
|---|---|---|---|
| `action` | string | Yes | Short verb phrase, max **24 chars** (e.g., `delete_file`, `send_email`, `publish_skill`). Shown on the display header line. |
| `message` | string | Yes | Brief explanation, max **60 chars** ideal, **80 chars** hard limit. Shown as 2 lines of ~29 chars each on the physical display. Keep it concise — long text gets truncated. (e.g., `Delete /tmp/old-logs? Cannot undo.`) |

#### When to Use

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/openclaw-interaction-bridge/SKILL.md (reported line 87)May include surrounding context.

text
request_user_approval({
  action: "delete_important_configuration_file",  // too long for header
  message: "Delete /home/pi/old-config.yaml? This file has not been modified in 90 days and contains important settings."  // way too long
})

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/openclaw-interaction-bridge/SKILL.md (reported line 221)May include surrounding context.

md
- **Notifications not showing**: Check that the plugin can reach Snarling on port 5000
- **Notification feedback not received**: Verify the gateway callback route on port 18789 is accessible; check gateway logs for `/notification-callback` hits
- **Stuck approval lock**: Wait 30 minutes for the stale timeout, or restart the gateway
- **Plugin not loading**: Check `openclaw gateway restart` logs for errors; verify `npm install` completed; clear jiti cache with `rm -f /tmp/jiti/openclaw-interaction-bridge-*.cjs`

## Install from ClawHub

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skills/openclaw-interaction-bridge/README.md (reported line 7)May include surrounding context.

md
## What It Does

- **State display**: Automatically sends agent state changes (processing, communicating, sleeping) to Snarling's display
- **Physical approvals**: Registers a `request_user_approval` tool that routes yes/no decisions to Snarling's A/B buttons
- **Notifications**: Registers a `send_notification` tool that sends alerts to the display with priority-based timeouts and full two-way feedback
- **Notification feedback**: Receives callback data from Snarling (revealed, dismissed, timed out) with timing metrics, enabling notification attunement

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/openclaw-interaction-bridge/README.md (reported line 187)May include surrounding context.

Query the stats:

bash
curl -s -X POST http://localhost:18789/approval-callback \
  -H "Authorization: Bearer <gateway-token>" \
  -H "Content-Type: application/json" \
  -d '{"action":"stats"}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
78% confidence
Finding

The architecture explicitly notes a WebSocket RPC wake that bypasses the gateway's 'requests-in-flight' check. Bypassing a built-in coordination or gating mechanism can let an external companion influence agent execution timing or resume flows unexpectedly, increasing the chance of unauthorized or unintended autonomous behavior if the channel is abused.

Content

Scanner excerpt · skills/openclaw-interaction-bridge/README.md (reported line 212)May include surrounding context.

↓ (WebSocket RPC wake) ← bypasses gateway requests-in-flight

text

No approval_server middleman — the plugin talks directly to Snarling. Snarling resolves approvals and notifications via its A/B buttons and POSTs the result back to the gateway.

### Environmental Events (V2 Protocol)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README documents functionality beyond a simple interaction bridge: it accepts environmental and presence observations and can wake a target agent based on those events. This expands the plugin's trust boundary and creates a sensor-driven input channel into the agent, which can influence behavior or trigger processing without a clear minimization or authorization model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes collecting and transmitting presence/environmental observation data but does not clearly warn about privacy implications, retention, consent, or who can access the data. Presence telemetry can reveal occupancy patterns and routines, so omitting privacy guidance increases the risk of unsafe deployment and unintended surveillance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.