OpenClaw Web Chat Pro

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the package may modify files outside this skill, and it is unclear which server file the documented startup path is meant to run.

Why it was flagged

The user is instructed to run npm install/npm start, but this lifecycle script may copy files into a different OpenClaw workspace path and suppress errors; the start target also does not match the provided code file manifest.

Skill content

"start": "node src/server.js", "postinstall": "cp -r public/* ~/.openclaw/workspace/chat-web/public/ 2>/dev/null || true"

Recommendation

Inspect package scripts before installing, avoid lifecycle scripts unless needed, and ask the publisher to remove hidden side effects and align the runtime entry point with the reviewed source.

ConcernMedium Confidence

ASI05: Unexpected Code Execution

What this means

If exposed through the web server or insufficiently constrained, chat/API activity could cause programs to run under the installing user's local account.

Why it was flagged

The backend can spawn a local process using dynamic command and argument variables, but the skill description does not clearly disclose local command execution or its allowed scope.

Skill content

const child = spawn(cmd, args, { env, shell: false });

Recommendation

Do not expose this server beyond a trusted local environment until the command execution path is reviewed, allowlisted, and documented.

ConcernMedium Confidence

ASI05: Unexpected Code Execution

What this means

A malicious message or model response could potentially run script in the browser and read page data such as session identifiers or password fields.

Why it was flagged

A shipped frontend inserts chat message content into innerHTML without escaping, which can turn untrusted user or model text into browser-executable HTML/JavaScript if that page is served.

Skill content

div.innerHTML = `... ${msg.content.replace(/\n/g, '<br>')} ...`;

Recommendation

Remove old public pages or render messages with textContent/strict sanitization before serving this app.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If the service is reachable by other users or the network, unauthorized people may be able to access or use the chat app more easily.

Why it was flagged

The documented default password is weak and the CORS setting is fully permissive for a web app that stores conversations and exposes chat/history APIs.

Skill content

PASSWORD=admin123
ALLOWED_ORIGINS=*

Recommendation

Change the password before first use, restrict allowed origins, and keep the service bound to localhost unless it is placed behind properly configured authentication.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A compromised or changed CDN script could run in the chat page and access page content.

Why it was flagged

The chat UI loads a third-party Markdown script from a CDN at runtime. This is purpose-aligned for Markdown rendering, but it is not pinned with an integrity check in the artifact.

Skill content

<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>

Recommendation

Bundle the dependency locally or pin it to a specific version with Subresource Integrity.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Chat sessions may remain accessible from the same browser or exported history after the immediate task is finished.

Why it was flagged

The browser persists a session identifier, matching the advertised session-persistence feature, but persistent chat sessions can retain sensitive context.

Skill content

SESSION_ID = localStorage.getItem('webchat_session_id'); ... localStorage.setItem('webchat_session_id', SESSION_ID);

Recommendation

Avoid entering secrets unless needed, clear stored sessions when finished, and protect the browser/profile used with this app.

Findings (4)

critical

suspicious.dangerous_exec

Location: src/server-v15.js:227
Finding: Shell command execution detected (child_process).

critical

suspicious.exposed_secret_literal

Location: src/public/index-v5.html:443
Finding: File appears to expose a hardcoded API secret or token.

critical

suspicious.exposed_secret_literal

Location: src/public/index-v6.html:1114
Finding: File appears to expose a hardcoded API secret or token.

critical

suspicious.exposed_secret_literal

Location: src/public/index.html:548
Finding: File appears to expose a hardcoded API secret or token.