Quest Board

Visual project dashboard managing quests, priorities, progress, and infrastructure via quest-board-registry.json with build and init commands.

This skill appears to do exactly what it claims: scan your workspace for Markdown files (to build a registry), generate a local JSON registry file, and render an interactive HTML dashboard. Before installing or running it: 1) review the generated quest-board-registry.json (it will be created/updated in your workspace) and don't include sensitive files in the registry; 2) be aware the dashboard embeds the registry JSON directly into the HTML — opening the page runs its script against that data, so avoid loading untrusted registry content; 3) the UI provides buttons that copy file paths to clipboard and open file:// directories in your browser — these are expected features but they expose local paths and may be blocked by some browsers; and 4) because init.sh scans many folders, run it in a workspace you trust or run it manually after review. If you want to harden: run init.sh in a disposable workspace copy, or modify build.sh to JSON-serialize/escape the registry before embedding to reduce injection risk.

Type: OpenClaw Skill Name: quest-board Version: 0.1.0 The skill bundle contains multiple critical client-side JavaScript injection (XSS) vulnerabilities in `src/template.html`. The `__REGISTRY_DATA__` placeholder is directly replaced with the raw content of `quest-board-registry.json` within a `<script>` block, allowing arbitrary JavaScript execution if the registry file is compromised. Additionally, file paths and other project data (e.g., `p.name`, `p.desc`) are unsafely inserted into HTML attributes and `innerHTML` without proper escaping, and environment variables (`QUEST_BOARD_WORKSPACE`, `QUEST_BOARD_TITLE`) are also directly injected into JavaScript strings. These flaws could be exploited via prompt injection against the agent to write malicious content into the registry, leading to arbitrary code execution in the user's browser when `quest-board.html` is opened.