OpenClaw Wallpaper

OpenClaw 桌面壁纸 - 让 AI 住进你的桌面。支持流式对话、成就系统、上下文持久化、7x24稳定运行。自动安装 Lively Wallpaper，一键启动。

This skill is plausible for a desktop wallpaper chat bridge, but there are several red flags you should address before installing or running it: - Do not run any missing install scripts blindly. SKILL.md refers to scripts (install.ps1, start.bat, install-startup.bat) that are not in the provided file list — ask the publisher for them or inspect them carefully if they appear later. - Inspect wallpaper-server.js and remove or replace the hard-coded gatewayToken. Treat that token as sensitive: ask the author where it came from. Do not run the server until you configure it with a token you control (or confirm the embedded token is intentionally safe). - The UI server (ui-server.js) uses an absolute path to a specific Windows user directory. Update it to a path on your machine or serve files from the skill directory to avoid accidental access to unrelated user directories. - Expect the skill to write conversation history and logs under the skill directory — check file locations and permissions if you care about privacy. - The monitor uses Windows taskkill and will spawn detached node processes; if you run this on a machine with other Node apps, review the taskkill filter and restart logic to avoid unintended process termination. If you cannot confirm the origin of the embedded token or the missing scripts, treat the skill as untrusted. Ask the publisher for: the missing scripts, clarification about the embedded gateway token, and a version of ui-server.js that uses relative paths. After those are resolved, re-evaluate and consider running the skill inside a controlled environment (VM) first.

Type: OpenClaw Skill Name: openclaw-wallpaper Version: 0.2.1 The skill bundle implements an AI-powered desktop wallpaper with session persistence and stability monitoring. It is classified as suspicious due to several high-risk security flaws: a hardcoded 'gatewayToken' in 'wallpaper-server.js', the bridge server listening on all network interfaces ('0.0.0.0'), and the use of 'child_process.exec' to run 'taskkill' commands in 'wallpaper-monitor.js'. Additionally, 'wallpaper-ui/ui-server.js' contains hardcoded absolute local file paths. While these represent significant vulnerabilities (potential unauthorized access and command injection risks), there is no clear evidence of intentional malice or data exfiltration.