Myapp Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 1.0.31

Overview

The skill’s core app-creation behavior is coherent, but it stores and transmits long-lived credentials and user/app data through under-scoped network and install flows that users should review carefully.

Install only if you trust the fe-service operator, the configured MYAPP_API_BASE, and the local environment where the token will be stored. Prefer HTTPS and a fixed approved backend host, use short-lived or scoped tokens if available, avoid putting secrets or private content into app prompts, and avoid the unpinned npx/npm install paths unless you have separately vetted the CLI version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_common.sh:6

Finding

Long-Lived Authentication Token and User Identifiers Can Be Transmitted Over Plaintext HTTP

Content

View full analysis

/dev/null 2>&1 || { echo "error: required binary not found: $bin" >&2 exit 127 } done MYAPP_CURL_MAX_TIME="${MYAPP_CURL_MAX_TIME:-180}" CURL_OPTS=(-sS --connect-timeout 5 --max-time "${MYAPP_CURL_MAX_TIME}" -H "X-MYAPP-TOKEN: ${MYAPP_API_TOKEN}" -H "Content-Type: application/json") ``` ```bash # scripts/register.sh:22-44 payload=$(jq -n \ --arg dumi_id "$dumi_id" \ --arg cuid "$cuid" \ --arg query "$query" \ --arg app_name "$app_name" \ --arg html_content "$html_content" \ --argjson features "$features" \ --arg icon_base64 "${icon_base64:-}" \ --arg tag "${tag:-app}" \ '{ dumi_id: $dumi_id, cuid: $cuid, query: $query, app_name: $app_name, html_content: $html_content, features: $features, icon_base64: (if $icon_base64 == "" then null else $icon_base64 end), tag: $tag }') curl "${CURL_OPTS[@]}" -X POST "${MYAPP_API_BASE}/myapp/register" --data-binary "$payload" ``` ### Technical Analysis The API base is supplied through an environment variable and is not restricted to HTTPS or to an appr ...[truncated 1942 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: publish.sh:44

Finding

Mutable Unpinned ClawHub CLI Is Downloaded and Executed

Content

View full analysis

``` The surrounding instructions state that, when the CLI is unavailable, the agent should run: ```bash npm i -g clawhub # or npx clawhub@latest install ... ``` The release instructions also use an unpinned global install: ```bash # README.md:86-91 npm i -g clawhub clawhub login ``` ```bash # publish.sh:44-49 if command -v clawhub >/dev/null 2>&1; then echo "publishing via clawhub skill publish" clawhub skill publish . --version "$VERSION" elif command -v npx >/dev/null 2>&1; then echo "publishing via npx clawhub@latest skill publish" npx --yes clawhub@latest skill publish . --version "$VERSION" ``` ### Technical Analysis Both `npm i -g clawhub` and `npx --yes clawhub@latest` resolve a mutable package version at execution time. Consequently, the code that executes during installation or publication may differ from the code reviewed during this audit. The `--yes` option also removes an interactive confirmation that could otherwise alert the operator to package installation. The publishing path may execute with access to ClawHub login credentials and package contents, while automatic installation runs with the local privileges of the OpenClaw agent or user. This is a supply-chain weakness rather than evidence that the current ClawHub package is malicious. ### Attack Path 1. The upstream npm account, package publication process, registry, or a newly released package version is compromised or behaves unexpectedly. 2. A machine without a local `clawhub` executable follows the documented installation flow or enters the `npx` fallback in `publis ...[truncated 826 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:554

Finding

Predictable Shared Temporary Files Permit Symlink and Race Attacks

Content

View full analysis

contents into temporary files and validate them with node --check node -e " const fs = require('fs'); const html = fs.readFileSync('/tmp/_skill_check.html','utf8'); const scripts = html.match(/([\s\S]*?)<\/script>/gi) || []; scripts.forEach((s,i) => { const code = s.replace(/<\/?script[^>]*>/gi,''); fs.writeFileSync('/tmp/_check_'+i+'.js', code); }); " && node --check /tmp/_check_*.js 2>&1 ``` The instructions additionally require writing `html_content` to the fixed path `/tmp/_skill_check.html` before executing this command. ### Technical Analysis The validation process uses globally predictable filenames in a shared temporary directory. It does not create a private directory, request exclusive file creation, reject symbolic links, or remove stale output files. An unprivileged local process can pre-create `/tmp/_skill_check.html` or `/tmp/_check_0.js` as a symbolic link. A subsequent write can then overwrite a file reachable with the victim process's permissions. Concurrent Skill executions can also overwrite each other's inputs and outputs. Finally, the wildcard `/tmp/_check_*.js` may include stale or attacker-created JavaScript files unrelated to the current validation run. The files are passed to `node --check`, so the JavaScript is parsed rather than executed. The primary risks are file clobbering, validation confusion, denial of service, and cross-run interference—not direct JavaScript execution from this command alone. ### Attack Path 1. A local attacker predicts the fixed `/tmp/_check_0.js` filename. 2. The attacker creates that path as a symbolic link to a file writable by the account ...[truncated 755 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:490

Finding

Generated Presentations Execute Mutable Third-Party CDN JavaScript Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis The generated presentation loads Reveal.js directly from a third-party CDN. The URL pins only the major version (`@5`), so it can resolve to different package contents over time. No Subresource Integrity hash is provided to bind the resource to reviewed bytes. Although HTTPS protects the connection from ordinary network modification, it does not protect against compromise of the package, publisher account, CDN, or mutable version resolution. The remotely supplied JavaScript executes in the generated presentation's WebView origin with the same client-side privileges as the rest of the document. This behavior also conflicts with the broader goal of producing independently usable, self-contained HTML because presentations depend on network availability and external executable content. ### Attack Path 1. An attacker compromises the Reveal.js publication channel, the unpkg delivery path, or a future version selected by `@5`. 2. A user opens a generated presentation while connected to the network. 3. The WebView downloads the modified `reveal.js` resource. 4. The browser executes the attacker's JavaScript as part of the presentation. 5. The script can inspect and modify presentation content and use browser-accessible network or storage capabilities allowed by the WebView. ### Impact Assessment The attacker gains JavaScript execution within the generated presentation's browser/WebView context. Potential impact includes reading p ...[truncated 296 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (73)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板（必须使用）：

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏：游戏区域，尽量大，canvas 撑满整个左栏，不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层：必须用以下写法居中，禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板（必须使用）：

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏：游戏区域，尽量大，canvas 撑满整个左栏，不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层：必须用以下写法居中，禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/skills/myapp-creator/SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板（必须使用）：

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏：游戏区域，尽量大，canvas 撑满整个左栏，不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层：必须用以下写法居中，禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板(必须使用):

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏:游戏区域,尽量大,canvas 撑满整个左栏,不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层:必须用以下写法居中,禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板(必须使用):

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏:游戏区域,尽量大,canvas 撑满整个左栏,不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层:必须用以下写法居中,禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/skills/myapp-creator/SKILL.md (reported line 171)May include surrounding context.

CSS 骨架模板(必须使用):

html

<div id="app" style="width:100vw;height:100vh;display:flex;flex-direction:row;overflow:hidden;background:#1a1a2e;">
  <!-- 左栏:游戏区域,尽量大,canvas 撑满整个左栏,不留空白 -->
  <div id="game-area" style="flex:1;position:relative;min-width:0;">
    <canvas id="canvas" style="display:block;width:100%;height:100%;"></canvas>
    <!-- 开始/结束/暂停 遮罩层:必须用以下写法居中,禁止只写 top:0;left:0 导致内容贴左上角 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- ⑤ 方向键+暂停：固定在底部，始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- ⑤ 方向键+暂停：固定在底部，始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/skills/myapp-creator/SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- ⑤ 方向键+暂停：固定在底部，始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- 5 方向键+暂停:固定在底部,始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- 5 方向键+暂停:固定在底部,始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · skills/myapp-creator/skills/myapp-creator/SKILL.md (reported line 207)May include surrounding context.

md

</div>
       </div>
       -->
       <!-- 5 方向键+暂停:固定在底部,始终可见 -->
       <div id="controls" style="flex:0 0 auto;padding-top:0.8vh;">...</div>
     </div>
   </div>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The user-flow description says the agent generates HTML and then registers it with fe-service, but it does not clearly warn that user prompts, generated app content, and associated identifiers are transmitted to a backend and stored there. This lack of transparency creates a privacy and data-handling risk, especially since users may input sensitive requests believing the process is local or transient.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs use of npx clawhub@latest install ..., which fetches and executes the latest package version at runtime instead of a reviewed, pinned CLI version. This creates a supply-chain risk: a compromised or breaking future release of clawhub could run arbitrary code on the user's machine during installation, and the skill's auto-install flow makes that exposure more dangerous because it is presented as the normal path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the agent will automatically write environment variables into ~/.mcporter/mcporter.json, including an API token, without a clear up-front warning about modifying local configuration or storing credentials on disk. This is dangerous because users may not realize local config is being changed persistently, and plaintext credential storage can expose secrets to other local users, backups, or malware.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The manual install path also recommends npx --yes clawhub@latest install ..., again causing execution of unpinned remote code. Because this is framed as a fallback/debug path, users may run it directly with less scrutiny, increasing the chance of executing a malicious or incompatible release.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to write generated HTML to /tmp and run shell/Node commands (node -e, node --check) on that content. Even if intended only for syntax validation, this expands the trust boundary from pure content generation into local file and command execution, which can expose the host environment to command/tool misuse and creates an undisclosed side effect not necessary for normal skill operation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says users can create an HTML mini-app 'with one sentence' (一句话创建), which is a very broad invocation description that could overlap with many ordinary requests. The file does not provide specific trigger phrases, scope limits, or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest contains user-facing natural-language descriptions in Chinese, and there is no indication that the skill offers another language option or that it is intentionally restricted to a Chinese-speaking locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script falls back to executing npx --yes clawhub@latest, which fetches and runs the latest package version at publish time instead of a reviewed, fixed version. This creates a supply-chain risk: a compromised upstream package, typosquat, or breaking change could execute arbitrary code on the publisher's machine with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx --yes clawhub@latest skill publish . --version "$VERSION" performs remote package resolution and immediate execution of the newest published package version. In a publishing script, this is especially risky because it is likely run by maintainers with repository access and credentials, so a malicious or compromised package could steal tokens or modify published artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script collects session_id, dumi_id, cuid, and skill_version and sends them to a remote API, but this file shows no user notice, consent flow, or minimization of transmitted identifiers. Even if intended as an install-readiness check, transmitting linkable identifiers without clear disclosure creates a privacy and telemetry risk, especially if these values can be correlated across sessions or users.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The script performs an outbound POST to ${MYAPP_API_BASE}/myapp/skill/ping containing user/session-related data. In skill contexts, silent external transmission is security-relevant because it can leak operational metadata or user identifiers to a remote service, and the safety of the destination depends on external configuration not visible in this file.

Content

Scanner excerpt · scripts/ping.sh (reported line 29)May include surrounding context.

sh

skill_version: $skill_version
  }')

curl "${CURL_OPTS[@]}" -X POST "${MYAPP_API_BASE}/myapp/skill/ping" --data-binary "$payload"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script collects multiple caller-controlled fields, including html_content, query, app_name, dumi_id, features, and optional icon_base64, and sends them to a remote endpoint via curl. In an agent skill context, this is a real data-exfiltration/privacy risk because there is no validation of data sensitivity, no minimization, and no user-facing disclosure or consent mechanism before transmitting potentially sensitive content off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The curl call performs an external POST of the assembled payload to MYAPP_API_BASE/myapp/register, creating a network egress point for all included content. In a skill environment, outbound transmission is security-relevant because the destination is environment-controlled, the payload may contain sensitive data, and the script provides no integrity checks, destination restrictions, or user approval step.

Content

Scanner excerpt · scripts/register.sh (reported line 44)May include surrounding context.

sh

tag: $tag
  }')

curl "${CURL_OPTS[@]}" -X POST "${MYAPP_API_BASE}/myapp/register" --data-binary "$payload"

Static analysis

No suspicious patterns detected.