TG Canvas Mini App

Telegram Mini App Canvas with terminal and optional Control UI proxy. Renders agent-generated content (HTML, markdown, A2UI) in a Telegram Mini App; push wit...

This skill appears to do exactly what it says, but it exposes high privileges that you must manage carefully. Before installing: - Treat the terminal feature as if you were installing remote shell access: only put trusted Telegram user IDs into ALLOWED_USER_IDS. If you don't need the terminal, do not enable it (note: the UI feature is compiled in, but access still requires Telegram auth). Consider disabling or removing the PTY code if you want to eliminate this risk entirely. - Always set a strong PUSH_TOKEN and keep BOT_TOKEN and JWT_SECRET secret. The server refuses to start without PUSH_TOKEN; verify it is present and random (eg. openssl rand -hex 32). - Understand cloudflared behavior: tunnel traffic appears as localhost, so IP loopback checks are ineffective. The code author is aware and enforces PUSH_TOKEN, but misconfiguration could expose /push or /clear. Test endpoints from outside before trusting them. - If you enable the OpenClaw proxy (ENABLE_OPENCLAW_PROXY=true) be careful with OPENCLAW_GATEWAY_TOKEN; only set it if necessary and ensure the proxied origin is added to the gateway's allowedOrigins. - Review server.js and the startup scripts yourself (they're included) to confirm they match your operational expectations (especially JWT lifetime, token verification, and that the server does not read unexpected local credential files in your deployment setup). - Run the service in an isolated environment (or behind an authenticated reverse proxy / domain + TLS) for initial testing, and routinely update node-pty/ws dependencies for security patches. If you want, I can point to the exact lines where the PTY is spawned and where PUSH_TOKEN is enforced so you can audit them directly.

Type: OpenClaw Skill Name: openclaw-tg-canvas Version: 0.2.6 The skill is classified as suspicious primarily due to a critical Cross-Site Scripting (XSS) vulnerability in `miniapp/app.js`. The client-side code directly injects agent-provided HTML content using `innerHTML` and explicitly re-executes `<script>` tags without sanitization, allowing a malicious agent to execute arbitrary JavaScript within the Mini App. While the skill transparently discloses high-privilege features like a JWT-gated server-side terminal (shell access) and an optional OpenClaw Control UI proxy, and implements robust authentication and `PUSH_TOKEN` enforcement to mitigate `cloudflared` loopback bypass, the XSS vulnerability is a significant flaw that enables attacks against Mini App users, classifying it as suspicious rather than benign or malicious.