Myapp Creator
ReviewAudited by ClawScan on May 13, 2026.
Overview
The skill’s app creation behavior is mostly coherent, but its documented auto-install path can install/configure the skill and store a long-lived token without clear user review.
Install only if you expect generated apps/documents to be saved to fe-service. Before allowing any automatic install prompt, review and approve package installs, ~/.mcporter/mcporter.json changes, MYAPP_API_BASE, and MYAPP_API_TOKEN handling.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent following this flow could change the user’s local agent environment and store service credentials before the user has reviewed the exact changes.
The documented install flow has an agent automatically install CLI/package code and modify local OpenClaw configuration, including an unpinned `@latest` npx path, without clearly requiring user approval.
fe-service 会下发一段 install_prompt，由龙虾 agent 自动执行 ... 若本机无 `clawhub`，agent 需先 `npm i -g clawhub`（或 `npx clawhub@latest install ...`）... 并写入 `~/.mcporter/mcporter.json` ... **用户无需手动操作。**
Require explicit user confirmation before npm/npx/clawhub installs or config writes, pin CLI versions where possible, and show the exact ~/.mcporter/mcporter.json diff and token scope.
If the token is exposed or misconfigured, someone could potentially call the service’s myapp APIs with the user’s authorization context.
The skill requires a sensitive long-term token that authorizes fe-service myapp operations. This is expected for the integration, but it is privileged account/service access.
MYAPP_API_TOKEN: required: true sensitive: true description: fe-service 下发的长期 token，用于鉴权所有 /myapp/* 调用
Keep the token out of chat and logs, scope it to only the needed user/actions, rotate it periodically, and remove it from local config when the skill is no longer used.
Prompts, generated apps/documents, and user/device identifiers may be stored by the configured fe-service.
The registration tool packages the user ID, device ID, original prompt, generated HTML content, and feature list for submission to fe-service. This is purpose-aligned but is a real data flow off the local agent.
dumi_id: $dumi_id, cuid: $cuid, query: $query, app_name: $app_name, html_content: $html_content, features: $features
Use the skill only for content you are comfortable saving to fe-service, verify MYAPP_API_BASE is trusted, and ensure the service protects stored prompts and HTML content.
A wrong app_id or unintended update request could replace an existing saved app.
The update tool can submit a new HTML payload and feature list to overwrite an existing app record. That matches the stated update purpose, but it is mutation authority.
curl "${CURL_OPTS[@]}" -X POST "${MYAPP_API_BASE}/myapp/update" --data-binary "$payload"Confirm the target app and requested changes before updates, and rely on service-side ownership checks, versioning, or rollback where available.