赛博朋克主题

PassAudited by ClawScan on May 17, 2026.

Overview

This appears to be a disclosed OpenClaw cyberpunk UI theme installer, but it changes the local live OpenClaw UI and runs bundled theme JavaScript.

Install this only if you want to modify your local OpenClaw control UI. The behavior appears purpose-aligned, but because it edits local app files and runs bundled UI JavaScript, review the script/source if you do not trust the publisher and keep backups before applying.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Installing the theme can change the visible OpenClaw UI immediately, not just copy files into a workspace.

Why it was flagged

The skill clearly discloses that the default install immediately applies changes to the live local OpenClaw control UI.

Skill content

4. 默认立即把主题 apply 到 live OpenClaw control-ui

Recommendation

Use it only for an OpenClaw installation you intend to customize; consider using the documented skip/staging flow first if you want to inspect files before applying.

Low

#ASI05: Unexpected Code Execution

What this means

The theme is not only static images/CSS; its JavaScript can run in the OpenClaw UI page context to create the overlay and visual behavior.

Why it was flagged

The installer inlines the bundled theme JavaScript into the local OpenClaw control-ui HTML so it runs in the UI.

Skill content

script_block = f'    <script id="{SCRIPT_ID}">\n{js}\n    </script>\n' if js else '' ... index_html.write_text(html, encoding='utf-8')

Recommendation

Review the bundled JavaScript if you are cautious about UI scripts, and install only from a publisher you trust.

Info

#ASI10: Rogue Agents

What this means

A script remains in the workspace that can reapply the theme later if run.

Why it was flagged

The installer leaves an executable reapply helper in the workspace, but it is disclosed and does not run as a background process.

Skill content

target = workspace / TARGET_APPLY_SCRIPT_REL ... target.write_text(build_apply_wrapper(installer_path, default_dist_dir), encoding='utf-8') ... target.chmod(0o755)

Recommendation

Keep the generated script if you want easy reapplication; delete it if you do not want a persistent theme helper in the workspace.