← 返回 Skills 市场
gnh1201

Jsrt Claw

作者 Namhyeon, Go · GitHub ↗ · v0.1.0
cross-platform ⚠ suspicious
579
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install jsrt-claw
功能描述
Automate Windows system tasks by generating and running a single JavaScript file using Microsoft JsRT with COM objects and fallback support.
使用说明 (SKILL.md)

SKILL.md

jsrt-claw

Overview

JSRT enables control of a Windows system using the built-in Microsoft JsRT (JavaScript Runtime).

Depending on the execution environment, Microsoft JsRT may be referred to as:

  • WSH
  • Windows Scripting Host
  • cscript
  • jscript.dll

On classic Windows systems, the JScript engine is implemented in jscript.dll (JScript 5.x). When running via cscript or wscript, this engine is typically used unless hosted by another environment.

This skill generates and executes a single .js file that interacts with Windows using COM objects and built-in scripting capabilities.


Execution Flow

  1. Create a single JavaScript file using all references described in this document.
  2. Perform Windows operations using COM objects.
  3. Execute the script:
cscript YOUR_JS_FILE.js

Available Windows Capabilities

1. File System Access

COM objects:

  • Scripting.FileSystemObject
  • ADODB.Stream

Typical usage:

  • Reading and writing files
  • Creating and deleting directories
  • Handling text or binary streams

2. System & Runtime Information

COM objects and functions:

  • WScript.Shell
  • WbemScripting.SWbemLocator
  • GetObject

Example:

GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\"
          + this.computer + "\\" + this.namespace);

Use cases:

  • Executing Windows shell commands
  • Querying WMI
  • Retrieving system configuration
  • Accessing environment variables

3. HTTP Communication

Possible COM objects (availability depends on installed MSXML/WinHTTP components):

  • Microsoft.XMLHTTP
  • WinHttp.WinHttpRequest.5.1
  • Msxml3.XMLHTTP
  • Msxml2.XMLHTTP
  • Msxml2.XMLHTTP.7.0
  • Msxml2.XMLHTTP.6.0
  • Msxml2.XMLHTTP.5.0
  • Msxml2.XMLHTTP.4.0
  • Msxml2.XMLHTTP.3.0
  • Msxml2.XMLHTTP.2.6
  • Msxml2.ServerXMLHTTP
  • Msxml2.ServerXMLHTTP.6.0
  • Msxml2.ServerXMLHTTP.5.0
  • Msxml2.ServerXMLHTTP.4.0
  • Msxml2.ServerXMLHTTP.3.0

Fallback loading is strongly recommended.


4. Microsoft Office Automation (If Installed)

  • Excel.Application
  • PowerPoint.Application
  • Word.Application
  • Outlook.Application
  • Other Office-related COM objects

Required COM Object Loader (With Fallback Support)

All COM objects must be instantiated using the following CreateObject function.

It supports:

  • Single ProgID
  • Multiple ProgIDs (fallback chain)
  • Automatic retry until a working object is found
if (typeof CreateObject === "undefined") {
    var CreateObject = function(progId, serverName, callback) {
        var progIds = (progId instanceof Array ? progId : [progId]);

        for (var i = 0; i \x3C progIds.length; i++) {
            try {
                var obj = CreateObject.make(progIds[i], serverName);
                if (typeof callback === "function") {
                    callback(obj, progIds[i]);
                }
                return obj;
            } catch (e) {
                // Try next ProgID
            }
        }
        throw new Error("Unable to create COM object from provided ProgIDs.");
    };

    CreateObject.make = function(p, s) {
        if (typeof WScript !== "undefined") {
            if ("CreateObject" in WScript) {
                return WScript.CreateObject(p, s);
            } else {
                throw new Error("Built-in loader not available.");
            }
        } else if (typeof ActiveXObject !== "undefined") {
            return new ActiveXObject(p);
        } else {
            throw new Error("Could not find a loader");
        }
    };
}

Fallback Example (XMLHTTP)

var xhr = CreateObject([
    "Msxml2.XMLHTTP.6.0",
    "Msxml2.XMLHTTP.3.0",
    "Msxml2.XMLHTTP",
    "Microsoft.XMLHTTP",
    "WinHttp.WinHttpRequest.5.1"
]);

The loader attempts each ProgID in order until one succeeds.


JavaScript Runtime Version Detection

Use the following function to determine the runtime:

function getProcessVersion() {
    var getIEVersion = function() {
        var rv = -1;
        if (navigator.appName == 'Microsoft Internet Explorer') {
            var ua = navigator.userAgent;
            var re  = new RegExp("MSIE ([0-9]{1,}[\\.0-9]{0,})");
            if (re.exec(ua) != null)
                rv = parseFloat(RegExp.$1);
        }
        return rv;
    };

    if (typeof WScript !== "undefined") {
        return "Microsoft JScript " + WScript.Version;
    } else if (typeof navigator !== "undefined") {
        return (function(rv) {
            return "MSIE" + (rv \x3C 0 ? '' : (' ' + rv));
        })(getIEVersion());
    }
}

Polyfill Support

Because jscript.dll (JScript 5.x) does not support modern ECMAScript features, polyfills may be required.

WSH JScript Compatibility

JScript Version Introduced with IE Example User-Agent
5.6.x IE 6.0 Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
5.7.x IE 7.0 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
5.8.x IE 8.0 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)

Polyfill Discovery

Available polyfills can be checked at:

https://cdnjs.cloudflare.com/polyfill/

Fetching Polyfills

features Parameter Format

The features parameter must be a comma-separated list of feature keywords:

features=feature1,feature2,feature3

In URL query strings, commas must be URL-encoded:

features=feature1%2Cfeature2%2Cfeature3

Example:

  • Conceptual:

    features=default,es2015
    
  • URL-encoded:

    features=default%2Ces2015
    

Request Example

GET https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?version=4.8.0&features=default%2Ces2015
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)

The User-Agent must match the detected JScript compatibility level.


Compatibility Strategy

  1. Detect runtime using getProcessVersion()
  2. Instantiate COM objects using fallback arrays
  3. Identify unsupported JavaScript features
  4. Request polyfills using comma-separated features
  5. Inject polyfills before executing dependent logic
  6. Execute Windows automation logic safely under jscript.dll

Real-World Example

A real open-source project that applies this environment in practice is WelsonJS.

WelsonJS:

  • Runs on Windows using the built-in JScript runtime (jscript.dll)
  • Uses COM objects extensively
  • Implements fallback loading patterns
  • Uses core-js (formerly known as Babel polyfills) to bridge modern JavaScript features into legacy JScript environments

If you need concrete usage examples, implementation patterns, or real source code references, use a search function to look up:

  • WelsonJS project information
  • WelsonJS source code
  • WelsonJS core-js integration

Reviewing the WelsonJS project will provide practical references that can help when implementing JSRT-based automation code.


Summary

JSRT provides:

  • Direct Windows automation
  • COM-based system control
  • WMI querying
  • HTTP communication
  • Office automation
  • Multi-ProgID fallback support
  • Polyfill-based compatibility for jscript.dll

It is optimized for legacy Windows scripting environments while maintaining cross-version compatibility through structured fallback and polyfill strategies.

安全使用建议
This skill is coherent for Windows automation but produces and runs arbitrary JScript with full access to filesystem, shell, WMI, Office COM objects, and HTTP — which can be used to modify/delete files, execute commands, or exfiltrate data. If you plan to use it: (1) only run it on systems you control or test VMs; (2) always review the generated .js before running; (3) restrict network access when possible (or audit outbound requests); (4) avoid running with elevated privileges unless absolutely necessary; and (5) prefer explicit, minimal scripts rather than allowing the skill to generate broad-purpose scripts autonomously. If you need the skill for limited tasks, add usage constraints in prompts so it generates minimal, auditable actions.
功能分析
Type: OpenClaw Skill Name: jsrt-claw Version: 0.1.0 This skill is classified as suspicious because it explicitly instructs the AI agent on how to generate and execute JavaScript code on a Windows system with highly privileged capabilities. Specifically, it details the use of `WScript.Shell` for 'Executing Windows shell commands', which is a direct remote code execution (RCE) primitive. Additionally, it enables arbitrary file system access via `Scripting.FileSystemObject` and network communication for fetching remote scripts (e.g., polyfills from `cdnjs.cloudflare.com`), which could be leveraged for data exfiltration or downloading malicious payloads. While the document describes these as 'Windows automation' features, they represent significant vulnerabilities if exploited by a malicious prompt, making the skill inherently risky.
能力评估
Purpose & Capability
The name and description (Windows automation via Microsoft JsRT/WSH) match the SKILL.md content: the doc explains using COM objects (FileSystemObject, WScript.Shell, WMI, XMLHTTP, Office automation) and how to instantiate them. No unrelated credentials, binaries, or installs are requested.
Instruction Scope
Instructions direct generation and execution of an arbitrary .js script that can read/write files, run shell commands, query WMI (including remote WMI access patterns), automate Office, and make HTTP requests. Those actions are expected for an automation skill, but they are high-privilege capabilities: the SKILL.md does not limit or constrain what the generated script may do and recommends fetching polyfills from a CDN, which adds network activity and an external dependency.
Install Mechanism
There is no install spec and no code files — instruction-only. This minimizes supply-chain/install risk because nothing is downloaded or written by the platform installer itself. The only network reference is an optional runtime polyfill fetch (cdnjs) described in the instructions.
Credentials
The skill declares no environment variables, credentials, or config paths. The runtime instructions mention accessing environment variables and possible remote machine names (WMI), but that is coherent with Windows automation; the skill does not request unrelated secrets or broad credential access.
Persistence & Privilege
The skill is not forced-always and does not request persistent or elevated platform privileges. Model invocation is enabled (default) but that's normal; there is no evidence the skill attempts to alter other skills or system-wide agent configuration.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install jsrt-claw
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /jsrt-claw 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v0.1.0
jsrt-claw 0.1.0 - Initial release introducing skill overview and documentation. - Supports Windows automation via JScript (.js) using COM objects: FileSystem, Shell, WMI, HTTP, and Office Automation. - Provides a universal `CreateObject` loader with multi-ProgID fallback support. - Explains JavaScript runtime detection and polyfill strategies for legacy environments. - Includes guidance on requesting polyfills and maintaining compatibility with JScript 5.x.
元数据
Slug jsrt-claw
版本 0.1.0
许可证
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Jsrt Claw 是什么?

Automate Windows system tasks by generating and running a single JavaScript file using Microsoft JsRT with COM objects and fallback support. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 579 次。

如何安装 Jsrt Claw?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install jsrt-claw」即可一键安装,无需额外配置。

Jsrt Claw 是免费的吗?

是的,Jsrt Claw 完全免费(开源免费),可自由下载、安装和使用。

Jsrt Claw 支持哪些平台?

Jsrt Claw 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Jsrt Claw?

由 Namhyeon, Go(@gnh1201)开发并维护,当前版本 v0.1.0。

💬 留言讨论