Private Web App (PWA)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:37 PM UTC
• Version: 1.0.3

Overview

PrivateApp is a coherent personal dashboard, but its default network exposure, unauthenticated home-directory file access, and unauthenticated host power controls require review before installation.

Review this carefully before installing. Only run it behind a trusted private network, bind it to localhost unless you have strong network controls, change the file browser root away from your home directory, add authentication before exposing it to any network, and remove or lock down restart/shutdown and plugin-discovery management endpoints. Upgrade the frontend build dependencies and avoid the optional pipe-to-shell Tailscale install path unless you independently trust and verify it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: apps/file-browser/backend/routes.py:19

Finding

Unauthenticated Network Access to Home-Directory Files

Content

View full analysis

"$CONFIG_FILE" <

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: apps/system-monitor/backend/routes.py:279

Finding

Unauthenticated Remote Shutdown and Restart Endpoints

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:247

Finding

Remote Script Downloaded and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: apps/system-monitor/backend/routes.py:22

Finding

Unauthenticated Disclosure of Host, Resource, Service, and Process Information

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app_loader.py:217

Finding

Unauthenticated Discovery-Path Management Enables a Plugin Code-Execution Chain

Content

View full analysis

dict: expanded = str(Path(path).expanduser().resolve()) conn = _settings_conn() try: conn.execute( "INSERT INTO discovery_paths (path, label) VALUES (?, ?)", (expanded, label or Path(expanded).name), ) conn.commit() row_id = conn.execute("SELECT last_insert_rowid()").fetchone()[0] except sqlite3.IntegrityError: conn.close() raise ValueError(f"Path already registered: {expanded}") conn.close() Path(expanded).mkdir(parents=True, exist_ok=True) return { "id": row_id, "path": expanded, "label": label or Path(expanded).name, "enabled": True, } ``` ```python def _load_router(routes_py: Path, module_name: str) -> APIRouter | None: if not routes_py.exists(): return None try: spec = importlib.util.spec_from_file_location(module_name, str(routes_py)) ...[truncated 2034 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/server.py:480

Finding

Unauthenticated Push Subscription and Notification Abuse

Content

View full analysis

bool: try: conn = _db() conn.execute( """INSERT INTO subscriptions (endpoint, keys_json) VALUES (?, ?) ON CONFLICT(endpoint) DO UPDATE SET keys_json=excluded.keys_json, last_used_at=datetime('now')""", ( subscription["endpoint"], json.dumps(subscription.get("keys", {})), ), ) ``` ```python for sub in subscriptions: try: webpush( subscription_info=sub, data=payload, vapid_private_key=str(_VAPID_PR ...[truncated 1652 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (119)

Tainted flow: 'req' from os.environ.get (line 90, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is derived from the OPENCLAW_GATEWAY_URL environment variable and then used directly in urllib.request.urlopen, enabling configurable outbound network access. If an attacker can influence the environment or deployment config, they can redirect messages and any included sensitive content to an arbitrary host, creating an SSRF/exfiltration path.

Content

Scanner excerpt · scripts/commons/openclaw_client.py (reported line 65)May include surrounding context.

python

data=data,
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=10) as resp:
            return resp.status == 200

    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 90, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The synchronous helper repeats the same pattern: it reads a gateway URL from environment-controlled configuration and performs an outbound HTTP request without destination validation. This allows redirection of messages to attacker-controlled infrastructure if configuration is tampered with, with possible internal network access or data leakage.

Content

Scanner excerpt · scripts/commons/openclaw_client.py (reported line 95)May include surrounding context.

python

data=data,
            headers={"Content-Type": "application/json"},
        )
        with urllib.request.urlopen(req, timeout=10) as resp:
            return resp.status == 200

    except Exception as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated description focuses on installing and managing a PWA dashboard, but the documented built-in Files app and configuration expose file-browsing behavior over a configured root, including the example root of '~'. That mismatch is dangerous because users may authorize the skill for routine service management without realizing it can enumerate, read, and potentially share personal files from a broad filesystem scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated description focuses on installing and managing a PWA dashboard, but the documented built-in Files app and configuration expose file-browsing behavior over a configured root, including the example root of '~'. That mismatch is dangerous because users may authorize the skill for routine service management without realizing it can enumerate, read, and potentially share personal files from a broad filesystem scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The stated description focuses on installing and managing a PWA dashboard, but the documented built-in Files app and configuration expose file-browsing behavior over a configured root, including the example root of '~'. That mismatch is dangerous because users may authorize the skill for routine service management without realizing it can enumerate, read, and potentially share personal files from a broad filesystem scope.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

browserslist 4.28.1 is flagged for crash/prototype-write and unbounded memory growth issues when handling untrusted stats/query input. The dependency is genuinely present, but because it is part of frontend build tooling rather than deployed runtime code, the main realistic impact here is CI/local build disruption rather than direct compromise of end users.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

nanoid 3.3.11 is present as a transitive dependency and the reported flaws can cause infinite loops or overflow conditions for malformed size/generator inputs. In this lockfile it is primarily a build-tool dependency through postcss, so the risk is mostly denial of service in tooling rather than direct runtime compromise, but it remains a real dependency vulnerability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

postcss 8.5.6 is a real vulnerable dependency with multiple advisories including file-read and XSS-adjacent issues involving attacker-controlled CSS or sourcemap content. Because this project is a frontend build stack, processing untrusted CSS during builds or plugin integration could expose developer machines or CI environments, even though the dependency is not typically exposed directly at application runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

rollup 4.58.0 is identified as vulnerable to arbitrary file write via path traversal, which is a serious class of issue if attacker-controlled module paths, plugin outputs, or archive contents reach the bundler. In this package-lock it is a build dependency, so practical exploitation is most likely in developer or CI environments rather than against deployed users, but that can still result in source tampering or host compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

vite 5.4.21 is a real vulnerable dependency with multiple advisories affecting path traversal, filesystem deny bypass on Windows, and UNC-path/NTLM hash disclosure through launch-editor behavior. This is especially relevant in this skill because the project explicitly uses Vite for local frontend development and rebuild operations, meaning a maintainer is likely to run the vulnerable tooling and expose a realistic developer-environment attack surface.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The package permits installation of vite 5.4.21, which is flagged with multiple high-severity advisories including path traversal and Windows-specific file access/credential exposure issues. In a frontend project, Vite is often used in local development or preview servers; if those workflows are used on developer machines or exposed environments, the vulnerable tooling can be abused to read unintended files or disclose sensitive information.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 99% confidence

Finding

dangerouslySetInnerHTML is used on HTML derived from file contents, and the custom markdown pipeline permits unsanitized raw HTML plus unsanitized href/src attribute values. An attacker who can place or influence a markdown file in a browsed directory can trigger XSS, potentially stealing tokens, performing actions as the user, or pivoting within the PrivateApp origin.

Content

Scanner excerpt · apps/file-browser/frontend/src/App.tsx (reported line 310)May include surrounding context.

tsx

isMd ? (
              <div style={{ background: 'var(--card-bg)', borderRadius: 12, overflow: 'hidden', boxShadow: '0 0 0 0.5px var(--border)' }}>
                <div className="md-render" style={{ padding: 16, fontSize: 14, lineHeight: 1.7, overflow: 'auto', maxHeight: 'calc(100vh - 120px)', wordBreak: 'break-word' }}
                  dangerouslySetInnerHTML={{ __html: resolveImages(renderMarkdown(preview.content), preview.path) }} />
              </div>
            ) : (
              <div style={{ background: 'var(--card-bg)', borderRadius: 12, overflow: 'hidden', boxShadow: '0 0 0 0.5px var(--border)' }}>

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module is presented as a system monitor but also exposes restart and shutdown routes, which are destructive host power controls far beyond passive monitoring. In this skill context, that mismatch makes the capability more dangerous because operators may deploy it expecting read-only telemetry while inadvertently exposing full denial-of-service actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Including reboot and shutdown capabilities in endpoint code for a dashboard/monitoring plugin is not justified by the stated purpose and creates an unnecessary high-impact control plane. If reachable by an attacker or low-privilege user, it enables immediate host outage with a single request.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The restart endpoint performs a destructive action immediately with no evidence of confirmation, approval workflow, or safety interlock. In a remotely accessible web service, one mistaken click, forged request, or unauthorized API call can disrupt availability of the whole host.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The shutdown endpoint irreversibly powers off the machine without any visible confirmation or operator safeguard. Because shutdown directly terminates the service host, the impact is complete denial of service and potential operational disruption for everything running on the system.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

browserslist 4.28.1 is reported vulnerable to crash/prototype-write and memory growth conditions when handling untrusted browserslist-stats or crafted query inputs. Although this package is primarily used in build tooling here, if CI, plugins, or developer workflows ingest attacker-controlled stats/config data, it can cause denial of service or unsafe object mutation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

nanoid 3.3.11 is flagged for denial-of-service style flaws such as infinite loops or integer overflow in certain generator and size-handling paths. In this file it is a transitive dependency of build tooling, so exploitability depends on whether attacker-controlled values can reach those APIs, but the vulnerable version is genuinely present.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

postcss 8.5.6 is associated with several advisories including arbitrary file read, incomplete source map handling fixes, and XSS in generated CSS output. Since PostCSS commonly processes project and plugin-controlled CSS during frontend builds, these issues are real and become more concerning if the skill accepts untrusted themes, CSS, or source maps from plugins.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

rollup 4.58.0 is reported vulnerable to arbitrary file write via path traversal, which is a serious issue if an attacker can influence bundle output paths, plugin behavior, or processed module metadata. In this plugin-based dashboard skill, frontend build tooling may handle third-party plugin apps, making the build-chain context more sensitive than a closed, single-app setup.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

vite 5.4.21 is flagged for multiple high-severity issues including path traversal in optimized dependency map handling, Windows filesystem deny-list bypass, and launch-editor UNC-path credential disclosure. This is especially relevant because the skill explicitly uses Vite for frontend development/builds; developer machines and CI environments could be exposed when serving or processing crafted inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This project uses Vite in a version range that includes 5.4.21, which the finding identifies as affected by multiple advisories including path traversal and Windows-specific filesystem and credential disclosure issues. In the context of a personal dashboard with plugin apps, a vulnerable frontend build/dev tool increases supply-chain and local development exposure, especially if developers run Vite dev/preview servers or build untrusted plugins on Windows systems.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/commons/openclaw_client.py (reported line 3)May include surrounding context.

python

"""OpenClaw messaging client for PrivateApp apps.

Apps import this module to send messages to OpenClaw chat rooms
(Matrix, Discord, Telegram, etc.) through the OpenClaw gateway API.

Usage in an app's routes.py:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script invokes privileged Tailscale configuration and optionally installs Tailscale, granting capabilities well beyond ordinary per-user app installation. Combining elevated network reconfiguration with an installer for a personal dashboard materially increases the blast radius if the script or environment is compromised.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching a remote script and piping it directly to sh grants immediate code execution to content outside the repository with no integrity verification. If the remote server, dependency chain, or TLS trust path is compromised, the installer can execute arbitrary attacker-controlled commands on the user's machine.

Content

Scanner excerpt · scripts/install.sh (reported line 253)May include surrounding context.

sh

INSTALL_TS="${INSTALL_TS:-N}"
    if [[ "$INSTALL_TS" =~ ^[Yy] ]]; then
        if [[ "$PLATFORM" == "linux" ]]; then
            curl -fsSL https://tailscale.com/install.sh | sh
            echo "  ✅ Tailscale installed — run 'sudo tailscale up' to authenticate"
        elif [[ "$PLATFORM" == "macos" ]]; then
            if check_command brew; then

Static analysis

No suspicious patterns detected.