voice-ui

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The package intentionally reads the user's OpenClaw config to obtain an API key and exposes it via an unauthenticated, CORS-open HTTP endpoint while also allowing unauthenticated POSTs that spawn the local OpenClaw CLI with attacker-controlled messages — enabling credential exposure and remote code/FS modification via the agent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In index.html the user’s spoken/transcribed text (via Whisper) is sent to the server at /api/chat as { message: 'voice-uiから: ' + txt }, and server.cjs forwards that free text directly into the OpenClaw agent CLI (openclaw agent ... -m fullMessage), which then reads/translates it into actions (including UI/code edits) without first selecting any specific trusted item.