OpenClaw Deck

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:05 PM UTC
• Version: 0.1.0

Overview

This local chat deck is not clearly malicious, but it handles gateway tokens and connection targets unsafely enough that users should review it before installing.

Install only if you trust the publisher and can run it in a controlled local environment. Do not put gateway tokens in URLs, avoid opening shared deck links with gateway or token parameters, keep the gateway bound to localhost unless you have a clear reason, and update the Vite/build dependencies before broader use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/App.tsx:55

Finding

Gateway Authentication Token Forwarded to an Attacker-Controlled WebSocket Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/App.tsx:68

Finding

Gateway Authentication Tokens Accepted Through URL Query Parameters

Content

View full analysis

Remediation

View remediation

other

Note

• Location: src/App.css:1

Finding

Local Deck UI Makes an Undeclared Request to Google Fonts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The public description frames the skill as a local multi-column chat UI, but the behavior includes substantial gateway communication, agent execution, messaging, status queries, and persistent connection management. Even if the default target is localhost, this is materially more powerful than the description suggests and could mislead users into approving a skill that can drive agent actions and exchange data over a control channel.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

browserslist 4.28.1 is flagged for crashes/prototype write and unbounded memory growth when handling untrusted browserslist-stats or crafted queries. Although this dependency is part of the frontend build toolchain rather than the shipped UI runtime, it can still affect developer machines or CI systems and is more concerning than a purely cosmetic issue because it can cause denial of service and unsafe object mutation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

nanoid 3.3.11 is flagged for infinite-loop and integer overflow conditions in edge-case generator usage. Here it is an indirect development dependency, so exploitability depends on whether tooling paths can be influenced with attacker-controlled size values, but the issues are real and can lead to hangs or denial of service in build processes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

picomatch 4.0.3 is reported vulnerable to method injection and ReDoS via crafted glob patterns/extglobs. Since this package is commonly used by build tooling to match files, malicious patterns could cause excessive CPU use or incorrect matching in dev/CI contexts; in this skill that makes it a real but toolchain-scoped risk rather than a runtime compromise vector.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

postcss 8.5.6 is flagged for multiple issues including arbitrary file read, incomplete sourceMappingURL-related fixes, and XSS in generated CSS output. Even though it is a development dependency, these vulnerabilities are more serious because frontend build pipelines frequently parse external CSS and source maps; if untrusted assets are introduced, developer systems, CI secrets, or generated output could be impacted.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

rollup 4.57.1 is reported vulnerable to arbitrary file write via path traversal. In this project Rollup is part of the build stack, so the issue is unlikely to directly affect end users of the local chat UI, but it is significant for developers and CI because crafted inputs or plugins could potentially write files outside intended directories.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==6.4.1 — 4 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +1 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

vite 6.4.1 is flagged for several serious dev-server issues including path traversal, arbitrary file read via WebSocket, and denylist bypasses. This skill explicitly launches a local web interface, which makes Vite more contextually relevant and dangerous than a dormant library: if the dev server is exposed beyond localhost or used in an unsafe environment, these flaws could leak local files or weaken filesystem protections.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==6.4.1 — 4 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +1 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The project resolves Vite to a version flagged with multiple high-severity advisories, including path traversal and arbitrary file read issues in the dev server. Because this skill explicitly launches a local web interface for managing agents, running the vulnerable dev or preview tooling in a local environment can expose sensitive local files or developer workstation data if the service is reachable by an attacker or malicious webpage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to install packages and launch a web UI that communicates over the network, yet the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent may perform network-capable actions the user or platform policy did not clearly approve, increasing the chance of unintended package retrieval or local service interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The app accepts an authentication token from the URL query string, which is commonly exposed through browser history, copied/shared links, screenshots, referrer leakage to other resources, and local logs. In a chat deck UI that connects to agent backends, token disclosure could let another local user or any party with access to the URL reuse the token to connect to the gateway or impersonate the user session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code initializes a gateway client with a URL and token, then connects automatically, and later transmits user-provided text with client.runAgent(...). Although there is error logging, there is no confirmation prompt, user-facing notice, or explanatory comment warning that chat content will be sent over a network connection to an external gateway.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @babel/core==7.29.0 — 1 advisory(ies): CVE-2026-49356 (@babel/core: Arbitrary File Read via sourceMappingURL Comment)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

@babel/core 7.29.0 is flagged with an arbitrary file read issue via sourceMappingURL handling. In this skill it is only a development/build dependency, so exposure is limited to local build tooling or CI environments rather than the runtime UI itself, but it is still a real dependency risk if untrusted inputs are processed during builds.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: baseline-browser-mapping==2.9.19 — 1 advisory(ies): CVE-2026-45819 (baseline-browser-mapping process termination on invalid input causes denial of s)

Low

• Category: Supply Chain
• Confidence: 79% confidence

Finding

baseline-browser-mapping 2.9.19 is reported vulnerable to process termination on invalid input, which is a denial-of-service class issue. Because it is an indirect development dependency used in browser compatibility tooling, the practical risk to this chat deck skill is low, but the vulnerable package is present and could disrupt builds or tooling if fed malicious input.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"preview": "vite preview"
  },
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "zustand": "^5.0.3"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

},
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "zustand": "^5.0.3"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "zustand": "^5.0.3"
  },
  "devDependencies": {
    "@types/react": "^19.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"zustand": "^5.0.3"
  },
  "devDependencies": {
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^4.4.1",
    "typescript": "~5.7.2",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

},
  "devDependencies": {
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^4.4.1",
    "typescript": "~5.7.2",
    "vite": "^6.2.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"devDependencies": {
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^4.4.1",
    "typescript": "~5.7.2",
    "vite": "^6.2.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^4.4.1",
    "typescript": "~5.7.2",
    "vite": "^6.2.0"
  }
}

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The stylesheet imports Google Fonts from an external domain, which causes the local web interface to make outbound network requests at runtime. This leaks metadata such as client IP address and usage timing to a third party, and it also undermines the expectation that a 'local' interface can operate without external dependencies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The component explicitly calls toLocaleTimeString with the hard-coded locale "en-US", which imposes a specific language/locale choice on all users. This is a natural-language policy concern because users are not offered a locale choice and the file does not document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The sendMessage method transmits user-provided text, channel, and peer identifiers over the gateway, which is a network operation affecting user data. While the method name suggests messaging behavior, there is no confirmation prompt, user-facing warning, or inline disclosure about this transmission in the code itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.