openclaw menubar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:57 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches a macOS OpenClaw menu bar app, but it needs review because it handles authentication tokens and Electron web content with unsafe defaults.

Review before installing. This is not judged malicious, but install it only if you are comfortable with a local Electron app reading OpenClaw gateway credentials, running as a background menu bar process, and loading your gateway UI. The publisher should remove token logging, harden Electron settings, validate external links and OAuth callbacks, fix token file permissions or use Keychain, remove stale cross-platform/safety claims, and update vulnerable dependencies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/openclaw-menubar/renderer.js:448

Finding

DOM XSS in a Node-enabled Electron renderer can lead to local code execution

Content

View full analysis

📎 ${file.name} ${formatFileSize(file.size)} `; contentDiv.appendChild(fileDiv); ``` The same unsafe filename rendering pattern is also used when restoring history at `assets/openclaw-menubar/renderer.js:611-617`. ### Technical Analysis The name of a user-selected or drag-and-dropped file is interpolated directly into an HTML string and assigned to `innerHTML`. File names are attacker-influenced and can contain HTML metacharacters. A malicious filename can therefore terminate the intended element and introduce an element with an event handler, resulting in JavaScript execution. The affected alternate interface is `assets/openclaw-menubar/index.html`, which loads `renderer.js`. If this interface is loaded in the configured Electron window, injected JavaScript runs with: - `nodeIntegration: true` - `contextIsolation: false` - `enableRemoteModule: true` Consequently, renderer-level script execution can access Node.js APIs, read or modify files available to the user, and potentially invoke local programs. This converts a DOM injection issue into a local code-execution boundary failure. The standard launch path currently points to `index-webchat.html`, which does not load `renderer.js`. Therefore, this vulnerability is dormant in the default flow, but the vulnerable alternate interface remains package ...[truncated 1448 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/openclaw-menubar/main.js:44

Finding

OAuth authentication token is exposed in plaintext application logs

Content

View full analysis

{ event.preventDefault(); console.log('OAuth callback:', url); // Extract token from URL const match = url.match(/openclawmenubar:\/\/callback\?token=([^&]+)/); if (match && mb.window) { const token = match[1]; console.log('Received token:', token); // Send token to renderer process mb.window.webContents.send('oauth-token', token); ``` ### Technical Analysis The custom protocol callback includes an authentication token in its query string. The handler logs both: - The complete callback URL, which contains the token. - The extracted token itself. This creates two plaintext copies of the credential in application or system logging infrastructure. Log retention, diagnostic collection, terminal capture, or access by another local process may expose the credential long after the authentication event has completed. The value is logged before being sent to the renderer, and no redaction or token fingerprinting is applied. ### Attack Path 1. The user completes an authentication flow that opens an `openclawmenubar://callback?token=...` URL. 2. Electron dispatches the URL to the `open-url` handler. 3. The handler writes the complete URL and extracted token to logs. 4. A local attacker, support bundle recipient, monitoring product, or process with log access retrieves the token. 5. The recovered token is reused to authenticate to the OpenClaw gateway within the token’s validity and authorization scope. ### Impact Assessment The exposed credential may permit impersonation of the authenticated user to the OpenClaw gateway. The exact accessible operations depend on the token’s server-side permissions, but may include access to chat sessions, gateway fu ...[truncated 175 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/openclaw-menubar/renderer.js:153

Finding

Gateway authentication token is persisted without explicit restrictive permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/openclaw-menubar/main.js:152

Finding

Untrusted URLs from gateway content are forwarded to operating-system protocol handlers

Content

View full analysis

{ require('electron').shell.openExternal(url); return { action: 'deny' }; }); ``` ### Technical Analysis The BrowserView renders content served by the local OpenClaw gateway. Whenever that content attempts to open a new window, the application passes the supplied URL directly to Electron’s `shell.openExternal()` without validating its scheme, host, port, or origin. `shell.openExternal()` delegates the URL to the operating system. It is not limited to ordinary HTTPS links and can invoke applications registered for custom URI schemes. A compromised gateway, injected gateway response, or malicious link rendered by gateway content could therefore cause the operating system to launch another application or invoke a custom protocol handler with attacker-controlled parameters. Returning `{ action: 'deny' }` only prevents Electron from creating a new window; it does not neutralize the external protocol invocation. ### Attack Path 1. An attacker controls or injects content displayed by the OpenClaw gateway. 2. The content calls `window.open()` or activates a link configured to open a new browsing context. 3. Electron supplies the attacker-controlled URL to `setWindowOpenHandler`. 4. The handler passes the URL directly to `shell.openExternal()`. 5. macOS invokes the application registered for the URL scheme. 6. If the selected protocol handler performs sensitive actions or contains its own argument-handling vulnerability, attacker-controlled behavior occurs outside the Electron application. ### Impact Assessment Direct impact includes unauthorized application launches and invocation of arbitrary registered URL schemes. The ultimate privileges are those of the current macOS ...[truncated 242 chars]

Remediation

View remediation

{ try { const parsed = new URL(url); const allowedHosts = new Set(['docs.openclaw.ai']); if (parsed.protocol === 'https:' && allowedHosts.has(parsed.hostname)) { shell.openExternal(parsed.toString()); } } catch { // Reject malformed URLs. } return { action: 'deny' }; }); ``` 3. Reject `file:`, `javascript:`, `data:`, custom application schemes, and URLs containing embedded credentials. 4. Use a strict hostname allowlist rather than allowing every HTTP or HTTPS destination. 5. Consider displaying an explicit user confirmation that shows the normalized destination before leaving the application. 6. Add equivalent controls for redirects and in-place navigation through `will-navigate` and related Electron navigation events. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (70)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Connectivity testing, WebSocket diagnostics, and sending test messages to a local gateway are not implied by the narrow description of enabling a menu bar app. Even if intended for troubleshooting, these hidden active interactions can produce unexpected side effects, leak information, or create trust issues around what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Connectivity testing, WebSocket diagnostics, and sending test messages to a local gateway are not implied by the narrow description of enabling a menu bar app. Even if intended for troubleshooting, these hidden active interactions can produce unexpected side effects, leak information, or create trust issues around what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Connectivity testing, WebSocket diagnostics, and sending test messages to a local gateway are not implied by the narrow description of enabling a menu bar app. Even if intended for troubleshooting, these hidden active interactions can produce unexpected side effects, leak information, or create trust issues around what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Connectivity testing, WebSocket diagnostics, and sending test messages to a local gateway are not implied by the narrow description of enabling a menu bar app. Even if intended for troubleshooting, these hidden active interactions can produce unexpected side effects, leak information, or create trust issues around what the skill actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Connectivity testing, WebSocket diagnostics, and sending test messages to a local gateway are not implied by the narrow description of enabling a menu bar app. Even if intended for troubleshooting, these hidden active interactions can produce unexpected side effects, leak information, or create trust issues around what the skill actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

Edit `assets/openclaw-menubar/main.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

Edit `assets/openclaw-menubar/main.js`:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/README.md (reported line 186)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/START.md (reported line 124)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/README.md (reported line 186)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/START.md (reported line 124)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/README.md (reported line 186)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/openclaw-menubar/START.md (reported line 124)May include surrounding context.

bash

# Clear cache and retry
rm -rf ~/Library/Application\ Support/openclaw-menubar
npm start

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

brace-expansion 1.1.12 is reported with DoS-style issues involving pathological expansion patterns. In this file it is a transitive dev/build dependency, so exploitation would more likely affect local build tooling or CI rather than end users, but vulnerable tooling in the supply chain is still risky.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

minimatch 3.1.2 has reported ReDoS issues and appears as a transitive build dependency. Although this is not direct runtime app logic, maliciously crafted glob patterns or attacker-influenced inputs in build/packaging contexts could hang processes or CI jobs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @xmldom/xmldom==0.8.11 — 15 advisory(ies): CVE-2026-83608 (xmldom: DocType `name` Injection Bypasses requireWellFormed); CVE-2026-41673 (xmldom: Uncontrolled recursion in XML serialization leads to DoS); CVE-2026-83605 (xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed) +12 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

@xmldom/xmldom has multiple XML parsing/serialization advisories and is present through plist-related build tooling. The main risk is malformed XML or plist content triggering parser bugs during packaging/signing steps, which is more limited than a network-exposed parser but still a real dependency risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: app-builder-lib==24.13.3 — 1 advisory(ies): CVE-2026-54672 (electron-updater: Uncontrolled search path elements within `AppImage` built by `)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

app-builder-lib is a packaging dependency with an advisory tied to updater/AppImage behavior. Because this skill is macOS-focused, the specific vulnerable path may be less relevant operationally, but keeping a vulnerable Electron build stack still increases supply-chain and release-process risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

axios is a direct runtime dependency, and the advisory set includes issues with SSRF/prototype-pollution-related abuse and redirect/proxy handling. In an Electron menubar app, network libraries execute in a privileged desktop context, so misuse or exploitation can expose local data, tokens, or internal network access more readily than in a normal web page.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

brace-expansion 2.0.2 is another vulnerable instance with DoS-style expansion issues. As with the earlier finding, the risk is mainly build-time or tooling availability impact rather than direct user compromise, but it remains a true vulnerable dependency in the lockfile.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: builder-util-runtime==9.2.4 — 1 advisory(ies): CVE-2026-54673 (electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Au)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

builder-util-runtime is part of Electron packaging/publishing infrastructure and is flagged for token leakage across redirects. Even though the file shown is a lockfile, if these build or update components are used in release automation, secrets and update metadata could be exposed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

minimatch 9.0.5 is flagged for ReDoS issues. This instance is likely tooling-related, so exploitation would generally require attacker influence over glob patterns or file matching inputs during development/build, making it lower risk than a runtime parsing flaw but still valid.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: electron==28.3.3 — 16 advisory(ies): CVE-2026-34776 (Electron: Out-of-bounds read in second-instance IPC on macOS and Linux); CVE-2026-70609 (Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter); CVE-2026-34767 (Electron: HTTP Response Header Injection in custom protocol handlers and webRequ) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

electron 28.3.3 is a core runtime dependency, and advisories against Electron can directly affect desktop app security boundaries, IPC, protocol handling, and embedded Chromium behavior. In a menubar app with native integration, a vulnerable Electron runtime materially increases risk of local compromise, data exposure, or renderer-to-main abuse depending on the app's implementation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): GHSA-7pqw-9j4j-h8q3; GHSA-jmr9-qjv8-65gv

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

extract-zip is used by Electron download/install tooling and has known high-severity advisories, commonly around archive extraction safety. If archive contents or download sources can be influenced, this can lead to file overwrite or path traversal during build/install workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): GHSA-r4q5-vmmm-2653

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

follow-redirects is used by axios and redirect-handling flaws can enable SSRF, header leakage, or destination confusion. Because this project includes a direct network client in an Electron app, redirect issues are more concerning than in isolated build-only code.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): GHSA-hmw2-7cc7-3qxx

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

form-data is part of the HTTP client stack and has a reported high-severity advisory. In a desktop app making outbound requests, bugs in multipart handling can expose request integrity or enable abuse when attacker-controlled payloads are sent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.