mini-apps

Enables the creation of standalone React mini-apps for various functionalities like forms and dashboards using the Mini-Apps toolchain.

Install this skill

or

0/100

Security score

The mini-apps skill was audited on Mar 3, 2026 and we found 49 security issues across 4 threat categories, including 8 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

high line 809

Direct command execution function call

SourceSKILL.md

809	this.db.exec(`CREATE TABLE IF NOT EXISTS ...`);

high line 810

Direct command execution function call

SourceSKILL.md

810	this.db.exec(`CREATE INDEX IF NOT EXISTS ...`);

high line 936

Direct command execution function call

SourceSKILL.md

936	this.db.exec(`

high line 948

Direct command execution function call

SourceSKILL.md

948	this.db.exec(`

high line 1578

Direct command execution function call

SourceSKILL.md

1578	this.db.exec(`

high line 1589

Direct command execution function call

SourceSKILL.md

1589	this.db.exec(`

medium line 261

Template literal with variable interpolation in command context

SourceSKILL.md

261	name: `reminder-${eventId}`,

medium line 426

Template literal with variable interpolation in command context

SourceSKILL.md

426	message: `New booking: ${userName} scheduled a meeting for ${formatDate(dateTime)}`,

medium line 435

Template literal with variable interpolation in command context

SourceSKILL.md

435	message: `Your meeting "${title}" has been confirmed for ${formatDate(dateTime)}.`,

medium line 1058

Template literal with variable interpolation in command context

SourceSKILL.md

1058	return res.status(404).json({ error: `App "${appName}" not found` });

medium line 1089

Template literal with variable interpolation in command context

SourceSKILL.md

1089	return res.status(501).json({ error: `Method "${method}" not implemented` });

high line 561

Curl to non-GitHub URL

SourceSKILL.md

561	1. Run `curl -s -X POST http://localhost/api/apps/reload` to refresh the cache

high line 562

Curl to non-GitHub URL

SourceSKILL.md

562	2. Check status: `curl http://localhost/api/apps/<app-name>` should show `"status": "published"`, `"isBuilt": true`

medium line 688

Curl to non-GitHub URL

SourceSKILL.md

688	curl http://localhost:3080/apps/my-app/

medium line 691

Curl to non-GitHub URL

SourceSKILL.md

691	curl http://localhost:3080/apps/my-app/ \| grep -o 'src="[^"]*"'

medium line 694

Curl to non-GitHub URL

SourceSKILL.md

694	curl http://localhost:3080/apps/my-app/assets/index-xxxxx.js \| head -c 100

low line 1006

Fetch to external URL

SourceSKILL.md

1006	const response = await fetch('/api/apps/bridge', {

low line 1203

Fetch to external URL

SourceSKILL.md

1203	const response = await fetch('/api/apps/bridge', {

low line 1267

Fetch to external URL

SourceSKILL.md

1267	const response = await fetch('/api/apps/bridge', {

medium line 283

Webhook reference - potential data exfiltration

SourceSKILL.md

283	### 3. Webhooks (Built-in Capability)

medium line 285

Webhook reference - potential data exfiltration

SourceSKILL.md

285	Receive data from external services via webhook endpoints.

low line 291

Webhook reference - potential data exfiltration

SourceSKILL.md

291

webhooks:

medium line 299

Webhook reference - potential data exfiltration

SourceSKILL.md

299	\| `bridge.webhooks.getEndpointUrl(name)` \| Get webhook URL to share \| `endpointName: string` \|

medium line 300

Webhook reference - potential data exfiltration

SourceSKILL.md

300	\| `bridge.webhooks.onWebhookReceived(name, callback)` \| Listen for incoming data \| `endpointName: string, callback: (data) => void` \|

medium line 302

Webhook reference - potential data exfiltration

SourceSKILL.md

302	Example - Form submission webhook:

low line 305

Webhook reference - potential data exfiltration

SourceSKILL.md

305	// Get the webhook URL to embed in external forms

low line 306

Webhook reference - potential data exfiltration

SourceSKILL.md

306	const webhookUrl = await bridge.webhooks.getEndpointUrl('form-submit');

low line 307

Webhook reference - potential data exfiltration

SourceSKILL.md

307	console.log('Share this URL:', webhookUrl);

low line 311

Webhook reference - potential data exfiltration

SourceSKILL.md

311	const cleanup = bridge.webhooks.onWebhookReceived('form-submit', (data) => {

low line 482

Webhook reference - potential data exfiltration

SourceSKILL.md

482

webhooks:

low line 1136

Webhook reference - potential data exfiltration

SourceSKILL.md

1136	// For capabilities (scheduler, webhooks, storage)

low line 1341

Webhook reference - potential data exfiltration

SourceSKILL.md

1341	webhooks?: { enabled?: boolean };

low line 1353

Webhook reference - potential data exfiltration

SourceSKILL.md

1353	// Webhooks capability

low line 1354

Webhook reference - potential data exfiltration

SourceSKILL.md

1354	if (method.startsWith('webhooks.')) {

low line 1355

Webhook reference - potential data exfiltration

SourceSKILL.md

1355	if (!capabilities?.webhooks?.enabled) {

low line 1356

Webhook reference - potential data exfiltration

SourceSKILL.md

1356	throw new Error('Capability denied: webhooks not enabled in APP.yaml');

medium line 1512

Webhook reference - potential data exfiltration

SourceSKILL.md

1512	This guide explains how to add a new capability to the mini-apps bridge (like storage, scheduler, webhooks). Follow these steps when implementing new backend services that mini-apps can access.

low line 1546

Webhook reference - potential data exfiltration

SourceSKILL.md

1546	webhooks: WebhookCapabilitySchema.optional(),

low line 1708

Webhook reference - potential data exfiltration

SourceSKILL.md

1708	webhooks?: { enabled?: boolean };

low line 725

Access to .env file

SourceSKILL.md

725	const path = dbPath \|\| process.env.SQLITE_DB_PATH \|\| './data/orient.db';

low line 928

Access to .env file

SourceSKILL.md

928	const path = dbPath \|\| process.env.SQLITE_DB_PATH \|\| './data/orient.db';

low line 1569

Access to .env file

SourceSKILL.md

1569	const path = dbPath \|\| process.env.SQLITE_DB_PATH \|\| './data/orient.db';

low line 561

External URL reference

SourceSKILL.md

561	1. Run `curl -s -X POST http://localhost/api/apps/reload` to refresh the cache

low line 562

External URL reference

SourceSKILL.md

562	2. Check status: `curl http://localhost/api/apps/<app-name>` should show `"status": "published"`, `"isBuilt": true`

low line 563

External URL reference

SourceSKILL.md

563	3. Preview at: `http://localhost/apps/<app-name>/`

low line 635

External URL reference

SourceSKILL.md

635	proxy_pass http://dashboard_api_local/apps/;

low line 688

External URL reference

SourceSKILL.md

688	curl http://localhost:3080/apps/my-app/

low line 691

External URL reference

SourceSKILL.md

691	curl http://localhost:3080/apps/my-app/ \| grep -o 'src="[^"]*"'

low line 694

External URL reference

SourceSKILL.md

694	curl http://localhost:3080/apps/my-app/assets/index-xxxxx.js \| head -c 100

Scanned on Mar 3, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2

Rate this skill

Categorydevelopment

UpdatedMay 21, 2026

openclaw frontend api frontend-developer product-manager growth-pm development product

majiayu000/claude-skill-registry-data