Skills
Navigate
skills/asif2bd/jarvis-mission-control-openclaw/jarvis-mission-control/Gen Agent Trust Hub

jarvis-mission-control

Fail

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The ecosystem.config.cjs configuration file includes hardcoded production-ready credentials, specifically MC_AUTH_PASS set to 'ZionMatrix2026!', along with hex-encoded tokens for MC_AGENT_TOKEN and OPENCLAW_GATEWAY_TOKEN.
  • [COMMAND_EXECUTION]: The server exposes an API endpoint at /api/cli/run that executes whitelisted shell commands (e.g., openclaw, uptime, df, free, node) using execFile. This allows interaction with the host system via the dashboard.
  • [EXTERNAL_DOWNLOADS]: The system includes update scripts (scripts/update-mission-control.sh and scripts/check-updates.sh) that download metadata and software packages from missiondeck.ai and github.com.
  • [DATA_EXFILTRATION]: Local session metadata from tools like Claude Code and OpenClaw is scanned from the filesystem (server/claude-sessions.js, server/openclaw-sessions.js) and can be synced to a remote vendor platform (missiondeck.ai) via the cloud sync module.
  • [PROMPT_INJECTION]: The application ingests untrusted data from Telegram messages and GitHub issues without using explicit boundary markers or robust sanitization before displaying it in the command center or including it in task descriptions, which presents a risk of indirect prompt injection.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 18, 2026, 05:54 PM
Security Audit — agent-trust-hub — jarvis-mission-control