Voice UI

WarnAudited by ClawScan on May 10, 2026.

Overview

The voice UI purpose is coherent, but the included local server exposes powerful agent and file access without adequate safeguards.

Do not run this on an untrusted network or with valuable credentials until the server is locked to localhost, authenticated, path-safe, and requires review before code edits or commits. If you test it, use a throwaway workspace and scoped API keys.

Findings (6)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI02: Tool Misuse and Exploitation

What this means

A webpage or another machine that can reach the port could ask the user's agent to act, potentially using tools or editing files as the user.

Why it was flagged

An unauthenticated HTTP endpoint forwards caller-controlled messages to the OpenClaw CLI, with permissive CORS and no explicit localhost-only bind.

Skill content

res.setHeader('Access-Control-Allow-Origin', '*'); ... if (req.method === 'POST' && req.url === '/api/chat') { ... const response = await callOpenClaw(message); } ... const proc = spawn(OPENCLAW, args, { env: { ...process.env, NO_COLOR: '1' }, timeout: 180000 }); ... server.listen(PORT

Recommendation

Bind only to 127.0.0.1, remove wildcard CORS, add authentication/CSRF protection, and require explicit confirmation before any tool action that edits files or uses accounts.

Critical

#ASI02: Tool Misuse and Exploitation

What this means

A caller that can reach the server may be able to request parent-directory paths and read local files outside the skill directory, including configuration files.

Why it was flagged

The static file handler joins the raw request URL to the skill directory and reads it without normalizing and enforcing that it remains inside the intended static root.

Skill content

let filePath = req.url === '/' ? '/index.html' : req.url; filePath = path.join(__dirname, filePath); ... const content = fs.readFileSync(filePath);

Recommendation

Serve only an allowlisted static directory, decode and normalize paths safely, reject any path that escapes the directory, and do not expose this server to the network.

Medium

#ASI01: Agent Goal Hijack

What this means

A crafted message can be treated as a trusted voice-ui request and steer the agent into code-editing behavior.

Why it was flagged

A user-controlled phrase is used to add authoritative instructions that redirect the agent toward editing a local UI file.

Skill content

if (message.includes('voice-uiから')) { fullMessage = `${message}\n\n[コンテキスト: voice-uiアプリからのリクエストです。UIの変更は /Users/yuki/.openclaw/workspace/voice-ui/index.html を編集してください]`; }

Recommendation

Do not authenticate intent through prompt text; use server-side command parsing, authenticated UI actions, and user confirmation before code changes.

High

#ASI03: Identity and Privilege Abuse

What this means

Anyone able to reach the endpoint may be able to use the user's configured agent, workspace, model access, and local credentials.

Why it was flagged

Requests run as the configured OpenClaw 'voice' agent with the server process environment and any inherited credentials, without checking who made the request.

Skill content

const args = ['agent', '--agent', 'voice', '--session-id', 'voice-ui', '-m', fullMessage, '--json']; ... spawn(OPENCLAW, args, { env: { ...process.env, NO_COLOR: '1' } })

Recommendation

Use a least-privilege agent profile, require local authentication, avoid inheriting broad environment credentials, and restrict available tools for voice-ui requests.

Medium

#ASI05: Unexpected Code Execution

What this means

A malicious or accidental HTML/script response could run inside the local UI and call the same local endpoints.

Why it was flagged

User transcripts and agent replies are inserted as HTML instead of text, so untrusted content can become executable browser markup.

Skill content

d.innerHTML = `<div class="bubble">${txt.replace(/\n/g, '<br>')}</div>`;

Recommendation

Render chat text with textContent or a strict sanitizer, and avoid allowing model output to become HTML.

Low

#ASI10: Rogue Agents

What this means

Voice requests can result in persistent code changes rather than only temporary UI behavior.

Why it was flagged

The skill intentionally persists self-modifications through Git commits. This is disclosed and purpose-aligned, but it changes local code and history.

Skill content

UIやコードを編集したら、必ず以下を実行： cd /Users/yuki/.openclaw/workspace/voice-ui && git add -A && git commit -m "変更内容の説明"

Recommendation

Use this only in a disposable or version-controlled workspace, review diffs before trusting changes, and keep backups.