Ui Controller

• Analyzed: May 12, 2026, 4:00 AM
• Findings: 1
• Version: 0.0.1
• Hash: 81eccce05aa36b677ff9a67efa2c578ae76f99f5ce6511e676ed9bed67083df5
• Source: palm
• External report: View on VirusTotal

Findings (1)

```json { "classification": "suspicious", "summary": "The `skill.js` file contains a critical Remote Code Execution (RCE) vulnerability. It directly executes user-supplied input from `context.message` via `child_process.exec` without any sanitization or validation. This allows any user who can trigger the skill (via the `^\.ui` pattern defined in `task.yml`) to execute arbitrary shell commands on the host machine where the OpenClaw gateway is running. While the `ui_controller.py` script and its associated `task.yaml` appear benign and properly structured, the direct RCE in `skill.js` makes the overall bundle highly risky." } ```