← Back to Skills Marketplace
gnh1201

Jsrt Claw

by Namhyeon, Go · GitHub ↗ · v0.1.0
cross-platform ⚠ suspicious
579
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install jsrt-claw
Description
Automate Windows system tasks by generating and running a single JavaScript file using Microsoft JsRT with COM objects and fallback support.
README (SKILL.md)

SKILL.md

jsrt-claw

Overview

JSRT enables control of a Windows system using the built-in Microsoft JsRT (JavaScript Runtime).

Depending on the execution environment, Microsoft JsRT may be referred to as:

  • WSH
  • Windows Scripting Host
  • cscript
  • jscript.dll

On classic Windows systems, the JScript engine is implemented in jscript.dll (JScript 5.x). When running via cscript or wscript, this engine is typically used unless hosted by another environment.

This skill generates and executes a single .js file that interacts with Windows using COM objects and built-in scripting capabilities.


Execution Flow

  1. Create a single JavaScript file using all references described in this document.
  2. Perform Windows operations using COM objects.
  3. Execute the script:
cscript YOUR_JS_FILE.js

Available Windows Capabilities

1. File System Access

COM objects:

  • Scripting.FileSystemObject
  • ADODB.Stream

Typical usage:

  • Reading and writing files
  • Creating and deleting directories
  • Handling text or binary streams

2. System & Runtime Information

COM objects and functions:

  • WScript.Shell
  • WbemScripting.SWbemLocator
  • GetObject

Example:

GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\"
          + this.computer + "\\" + this.namespace);

Use cases:

  • Executing Windows shell commands
  • Querying WMI
  • Retrieving system configuration
  • Accessing environment variables

3. HTTP Communication

Possible COM objects (availability depends on installed MSXML/WinHTTP components):

  • Microsoft.XMLHTTP
  • WinHttp.WinHttpRequest.5.1
  • Msxml3.XMLHTTP
  • Msxml2.XMLHTTP
  • Msxml2.XMLHTTP.7.0
  • Msxml2.XMLHTTP.6.0
  • Msxml2.XMLHTTP.5.0
  • Msxml2.XMLHTTP.4.0
  • Msxml2.XMLHTTP.3.0
  • Msxml2.XMLHTTP.2.6
  • Msxml2.ServerXMLHTTP
  • Msxml2.ServerXMLHTTP.6.0
  • Msxml2.ServerXMLHTTP.5.0
  • Msxml2.ServerXMLHTTP.4.0
  • Msxml2.ServerXMLHTTP.3.0

Fallback loading is strongly recommended.


4. Microsoft Office Automation (If Installed)

  • Excel.Application
  • PowerPoint.Application
  • Word.Application
  • Outlook.Application
  • Other Office-related COM objects

Required COM Object Loader (With Fallback Support)

All COM objects must be instantiated using the following CreateObject function.

It supports:

  • Single ProgID
  • Multiple ProgIDs (fallback chain)
  • Automatic retry until a working object is found
if (typeof CreateObject === "undefined") {
    var CreateObject = function(progId, serverName, callback) {
        var progIds = (progId instanceof Array ? progId : [progId]);

        for (var i = 0; i \x3C progIds.length; i++) {
            try {
                var obj = CreateObject.make(progIds[i], serverName);
                if (typeof callback === "function") {
                    callback(obj, progIds[i]);
                }
                return obj;
            } catch (e) {
                // Try next ProgID
            }
        }
        throw new Error("Unable to create COM object from provided ProgIDs.");
    };

    CreateObject.make = function(p, s) {
        if (typeof WScript !== "undefined") {
            if ("CreateObject" in WScript) {
                return WScript.CreateObject(p, s);
            } else {
                throw new Error("Built-in loader not available.");
            }
        } else if (typeof ActiveXObject !== "undefined") {
            return new ActiveXObject(p);
        } else {
            throw new Error("Could not find a loader");
        }
    };
}

Fallback Example (XMLHTTP)

var xhr = CreateObject([
    "Msxml2.XMLHTTP.6.0",
    "Msxml2.XMLHTTP.3.0",
    "Msxml2.XMLHTTP",
    "Microsoft.XMLHTTP",
    "WinHttp.WinHttpRequest.5.1"
]);

The loader attempts each ProgID in order until one succeeds.


JavaScript Runtime Version Detection

Use the following function to determine the runtime:

function getProcessVersion() {
    var getIEVersion = function() {
        var rv = -1;
        if (navigator.appName == 'Microsoft Internet Explorer') {
            var ua = navigator.userAgent;
            var re  = new RegExp("MSIE ([0-9]{1,}[\\.0-9]{0,})");
            if (re.exec(ua) != null)
                rv = parseFloat(RegExp.$1);
        }
        return rv;
    };

    if (typeof WScript !== "undefined") {
        return "Microsoft JScript " + WScript.Version;
    } else if (typeof navigator !== "undefined") {
        return (function(rv) {
            return "MSIE" + (rv \x3C 0 ? '' : (' ' + rv));
        })(getIEVersion());
    }
}

Polyfill Support

Because jscript.dll (JScript 5.x) does not support modern ECMAScript features, polyfills may be required.

WSH JScript Compatibility

JScript Version Introduced with IE Example User-Agent
5.6.x IE 6.0 Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
5.7.x IE 7.0 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
5.8.x IE 8.0 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)

Polyfill Discovery

Available polyfills can be checked at:

https://cdnjs.cloudflare.com/polyfill/

Fetching Polyfills

features Parameter Format

The features parameter must be a comma-separated list of feature keywords:

features=feature1,feature2,feature3

In URL query strings, commas must be URL-encoded:

features=feature1%2Cfeature2%2Cfeature3

Example:

  • Conceptual:

    features=default,es2015
    
  • URL-encoded:

    features=default%2Ces2015
    

Request Example

GET https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?version=4.8.0&features=default%2Ces2015
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)

The User-Agent must match the detected JScript compatibility level.


Compatibility Strategy

  1. Detect runtime using getProcessVersion()
  2. Instantiate COM objects using fallback arrays
  3. Identify unsupported JavaScript features
  4. Request polyfills using comma-separated features
  5. Inject polyfills before executing dependent logic
  6. Execute Windows automation logic safely under jscript.dll

Real-World Example

A real open-source project that applies this environment in practice is WelsonJS.

WelsonJS:

  • Runs on Windows using the built-in JScript runtime (jscript.dll)
  • Uses COM objects extensively
  • Implements fallback loading patterns
  • Uses core-js (formerly known as Babel polyfills) to bridge modern JavaScript features into legacy JScript environments

If you need concrete usage examples, implementation patterns, or real source code references, use a search function to look up:

  • WelsonJS project information
  • WelsonJS source code
  • WelsonJS core-js integration

Reviewing the WelsonJS project will provide practical references that can help when implementing JSRT-based automation code.


Summary

JSRT provides:

  • Direct Windows automation
  • COM-based system control
  • WMI querying
  • HTTP communication
  • Office automation
  • Multi-ProgID fallback support
  • Polyfill-based compatibility for jscript.dll

It is optimized for legacy Windows scripting environments while maintaining cross-version compatibility through structured fallback and polyfill strategies.

Usage Guidance
This skill is coherent for Windows automation but produces and runs arbitrary JScript with full access to filesystem, shell, WMI, Office COM objects, and HTTP — which can be used to modify/delete files, execute commands, or exfiltrate data. If you plan to use it: (1) only run it on systems you control or test VMs; (2) always review the generated .js before running; (3) restrict network access when possible (or audit outbound requests); (4) avoid running with elevated privileges unless absolutely necessary; and (5) prefer explicit, minimal scripts rather than allowing the skill to generate broad-purpose scripts autonomously. If you need the skill for limited tasks, add usage constraints in prompts so it generates minimal, auditable actions.
Capability Analysis
Type: OpenClaw Skill Name: jsrt-claw Version: 0.1.0 This skill is classified as suspicious because it explicitly instructs the AI agent on how to generate and execute JavaScript code on a Windows system with highly privileged capabilities. Specifically, it details the use of `WScript.Shell` for 'Executing Windows shell commands', which is a direct remote code execution (RCE) primitive. Additionally, it enables arbitrary file system access via `Scripting.FileSystemObject` and network communication for fetching remote scripts (e.g., polyfills from `cdnjs.cloudflare.com`), which could be leveraged for data exfiltration or downloading malicious payloads. While the document describes these as 'Windows automation' features, they represent significant vulnerabilities if exploited by a malicious prompt, making the skill inherently risky.
Capability Assessment
Purpose & Capability
The name and description (Windows automation via Microsoft JsRT/WSH) match the SKILL.md content: the doc explains using COM objects (FileSystemObject, WScript.Shell, WMI, XMLHTTP, Office automation) and how to instantiate them. No unrelated credentials, binaries, or installs are requested.
Instruction Scope
Instructions direct generation and execution of an arbitrary .js script that can read/write files, run shell commands, query WMI (including remote WMI access patterns), automate Office, and make HTTP requests. Those actions are expected for an automation skill, but they are high-privilege capabilities: the SKILL.md does not limit or constrain what the generated script may do and recommends fetching polyfills from a CDN, which adds network activity and an external dependency.
Install Mechanism
There is no install spec and no code files — instruction-only. This minimizes supply-chain/install risk because nothing is downloaded or written by the platform installer itself. The only network reference is an optional runtime polyfill fetch (cdnjs) described in the instructions.
Credentials
The skill declares no environment variables, credentials, or config paths. The runtime instructions mention accessing environment variables and possible remote machine names (WMI), but that is coherent with Windows automation; the skill does not request unrelated secrets or broad credential access.
Persistence & Privilege
The skill is not forced-always and does not request persistent or elevated platform privileges. Model invocation is enabled (default) but that's normal; there is no evidence the skill attempts to alter other skills or system-wide agent configuration.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install jsrt-claw
  3. After installation, invoke the skill by name or use /jsrt-claw
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
jsrt-claw 0.1.0 - Initial release introducing skill overview and documentation. - Supports Windows automation via JScript (.js) using COM objects: FileSystem, Shell, WMI, HTTP, and Office Automation. - Provides a universal `CreateObject` loader with multi-ProgID fallback support. - Explains JavaScript runtime detection and polyfill strategies for legacy environments. - Includes guidance on requesting polyfills and maintaining compatibility with JScript 5.x.
Metadata
Slug jsrt-claw
Version 0.1.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Jsrt Claw?

Automate Windows system tasks by generating and running a single JavaScript file using Microsoft JsRT with COM objects and fallback support. It is an AI Agent Skill for Claude Code / OpenClaw, with 579 downloads so far.

How do I install Jsrt Claw?

Run "/install jsrt-claw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Jsrt Claw free?

Yes, Jsrt Claw is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Jsrt Claw support?

Jsrt Claw is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Jsrt Claw?

It is built and maintained by Namhyeon, Go (@gnh1201); the current version is v0.1.0.

💬 Comments