WebMCP

WebMCP - Enable AI agents to interact with your web applications through structured tools. Implements the WebMCP standard for Next.js/React apps with tool re...

This package is conceptually coherent for adding an agent→web-app bridge, but there are insecure defaults you should be aware of: the browser bridge posts messages with target '*' and the handleMessage code does not perform origin validation (the origin check is commented out). If you install/use this in a web app, only include the bridge on pages where you control both frame/parent origins, or modify the bridge to validate event.origin and restrict allowed origins before acting on messages. Also verify the CLI commands in the README—there is no @webmcp/cli included in the bundle; the repo provides shell scripts (init-webmcp.sh, add-tool.sh) instead. Before deploying to production: 1) add strict origin checks and consider stronger authentication/CSRF protections for mutating tools (login, submitForm, cart operations), 2) avoid exposing sensitive tool handlers in pages that could be framed by untrusted sites, and 3) review any UI code that will actually perform network requests so user credentials or sensitive data are not forwarded to unintended endpoints.

Type: OpenClaw Skill Name: web-mcp Version: 1.0.0 The skill is classified as suspicious due to several vulnerabilities and risky capabilities, despite lacking clear evidence of intentional malicious behavior. The `SKILL.md` declares `Bash` as an allowed tool, granting powerful execution capabilities. The `scripts/init-webmcp.sh` script contains a potential path traversal vulnerability when copying example projects, which could lead to arbitrary file writes. Most critically, the `assets/webmcp-bridge.js` uses `window.postMessage` with a wildcard origin (`*`) for cross-frame communication without origin validation, creating a significant vulnerability for message hijacking or data exposure in a multi-frame environment. While the example tools (e.g., `loginTool`, `exportChatTool`) provide powerful actions, they are presented as intended functionality rather than malicious instructions.