OpenClaw Web Chat Pro

生产级AI聊天网页应用，支持多模型、流式输出、会话持久化和导出，含文件上传、语音及多设备同步等高级功能。

What to check before installing: - Inspect package.json scripts: the root postinstall runs `cp -r public/* ~/.openclaw/workspace/chat-web/public/`. Decide whether you want files copied into that path; back up ~/.openclaw/workspace/chat-web/public beforehand. - Audit install-time scripts: src/package.json references `install.sh` and `postinstall.js` but those files aren't listed — confirm they aren't present or malicious before running npm install. - Review src/server-v15.js for any outbound network calls, telemetry, or hidden endpoints (send logs/credentials out). If you can't audit the file, run in an isolated VM or container. - Change the default PASSWORD (admin123) and avoid ALLOWED_ORIGINS=* in .env; enforce a strong password and restrict CORS to trusted origins. - To avoid unintended postinstall actions, consider running npm install with scripts disabled (e.g., npm install --ignore-scripts) while you inspect files, or inspect the package contents in a sandbox. - If you need private/production use, prefer deploying only after full code review; for casual testing run inside a disposable environment. If you cannot validate the install-time scripts and server code, treat this package as higher risk and do not install on a production machine.

Type: OpenClaw Skill Name: webchat-pro Version: 1.0.0 The skill bundle is classified as suspicious due to several significant vulnerabilities, primarily in `src/server-v15.js` and `src/public/index.html`. These include a hardcoded default password ('admin123'), plain text storage of the password in `chat-auth.json`, and client-side storage of the password in `sessionStorage`. Additionally, the `streamAI` function passes user-controlled input directly to the `openclaw agent` command, which, while using `shell: false`, could still pose a prompt injection risk if the `openclaw` agent itself is vulnerable to specially crafted arguments. The `postinstall` script in `package.json` copies files to a user's home directory, a broad permission that could be abused, though in this context it's for static assets. There is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized remote control.