Back to plugin

Security audit

OpenClaw Interaction Bridge v2

Security checks for vulnerabilities and agentic risk

Overview

The bridge is mostly purpose-aligned, but its default presence/environment event route can automatically wake or spawn an agent from sensor data with limited privacy and scoping guidance.

Install only if you intend Snarling or another trusted local companion to send approvals, notifications, and presence/observation events into OpenClaw. Review who has the gateway token, consider setting environmentalEventsEnabled=false or presenceTarget=disabled unless you want sensor-triggered agent turns, and treat notification/presence feedback as potentially sensitive routine data.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| Parameter | Type | Required | Description |
|---|---|---|---|
| `action` | string | Yes | Short verb phrase, max **24 chars** (e.g., `delete_file`, `send_email`, `publish_skill`). Shown on the display header line. |
| `message` | string | Yes | Brief explanation, max **60 chars** ideal, **80 chars** hard limit. Shown as 2 lines of ~29 chars each on the physical display. Keep it concise — long text gets truncated. (e.g., `Delete /tmp/old-logs? Cannot undo.`) |

#### When to Use
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```
request_user_approval({
  action: "delete_important_configuration_file",  // too long for header
  message: "Delete /home/pi/old-config.yaml? This file has not been modified in 90 days and contains important settings."  // way too long
})
```
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- **Notifications not showing**: Check that the plugin can reach Snarling on port 5000
- **Notification feedback not received**: Verify the gateway callback route on port 18789 is accessible; check gateway logs for `/notification-callback` hits
- **Stuck approval lock**: Wait 30 minutes for the stale timeout, or restart the gateway
- **Plugin not loading**: Check `openclaw gateway restart` logs for errors; verify `npm install` completed; clear jiti cache with `rm -f /tmp/jiti/openclaw-interaction-bridge-*.cjs`

## Install from ClawHub
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## What It Does

- **State display**: Automatically sends agent state changes (processing, communicating, sleeping) to Snarling's display
- **Physical approvals**: Registers a `request_user_approval` tool that routes yes/no decisions to Snarling's A/B buttons
- **Notifications**: Registers a `send_notification` tool that sends alerts to the display with priority-based timeouts and full two-way feedback
- **Notification feedback**: Receives callback data from Snarling (revealed, dismissed, timed out) with timing metrics, enabling notification attunement
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
Query the stats:

```bash
curl -s -X POST http://localhost:18789/approval-callback \
  -H "Authorization: Bearer <gateway-token>" \
  -H "Content-Type: application/json" \
  -d '{"action":"stats"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
↓ (WebSocket RPC wake)                        ← bypasses gateway requests-in-flight
```

No approval_server middleman — the plugin talks directly to Snarling. Snarling resolves approvals and notifications via its A/B buttons and POSTs the result back to the gateway.

### Environmental Events (V2 Protocol)
Confidence
78% confidence
Finding
The architecture explicitly notes a WebSocket RPC wake that bypasses the gateway's 'requests-in-flight' check. Bypassing a built-in coordination or gating mechanism can let an external companion influence agent execution timing or resume flows unexpectedly, increasing the chance of unauthorized or unintended autonomous behavior if the channel is abused.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The README documents functionality beyond a simple interaction bridge: it accepts environmental and presence observations and can wake a target agent based on those events. This expands the plugin's trust boundary and creates a sensor-driven input channel into the agent, which can influence behavior or trigger processing without a clear minimization or authorization model.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README describes collecting and transmitting presence/environmental observation data but does not clearly warn about privacy implications, retention, consent, or who can access the data. Presence telemetry can reveal occupancy patterns and routines, so omitting privacy guidance increases the risk of unsafe deployment and unintended surveillance.

Static analysis

No suspicious patterns detected.