A security research demonstration highlighting how SVG files can be used to execute scripts and access sensitive browser localStorage data.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install localstorage-poc
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install localstorage-poc using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is LocalStorage SVG PoC?
This skill is a specialized security research tool designed to demonstrate a specific Cross-Site Scripting (XSS) vector through SVG files. Originally developed by @theonejvo, it illustrates the potential for SVG images to execute JavaScript within a browser's context, allowing them to read sensitive data like authentication tokens from localStorage. By utilizing this within the Openclaw Skills ecosystem, developers and security professionals can verify the security posture of their web platforms and ensure that user-uploaded content does not pose a threat to session integrity.
LocalStorage SVG PoC Use Cases
- Conducting security audits on platforms that allow SVG file uploads.
- Demonstrating the risk of XSS via media files to engineering teams.
- Testing the effectiveness of Content Security Policy (CSP) headers against embedded scripts.
- Researching authentication token protection mechanisms within Openclaw Skills environments.
How LocalStorage SVG PoC Works
- The security researcher identifies or uploads a specifically crafted SVG file, such as icon.svg, which contains an embedded script block.
- The user navigates to the file while logged into the target platform, causing the browser to render the SVG.
- Upon rendering, the browser executes the embedded JavaScript within the platform's origin.
- The script programmatically accesses window.localStorage to retrieve keys, such as JSON Web Tokens (JWT) or session identifiers.
- The demonstration proves that the data is accessible, highlighting the need for stricter sanitization or isolated sandboxing.
LocalStorage SVG PoC Setup
To deploy this research PoC within your environment, ensure you have the necessary permissions for security testing.
# Navigate to your research directory
# Add the PoC file to your project
cat <<EOF > icon.svg
<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(JSON.stringify(localStorage));</script>
</svg>
EOF
Open the icon.svg file in a browser tab where you are currently authenticated to observe the access attempt.
LocalStorage SVG PoC Data Schema & Taxonomy
The skill focuses on identifying vulnerabilities within standard browser storage structures. The following data points are involved in the research:
| Component | Description |
|---|---|
| icon.svg | The payload container used to execute the proof of concept script. |
| window.localStorage | The target browser API containing persistent session data and auth tokens. |
| Origin Context | The security boundary defined by the domain where the SVG is hosted. |
LocalStorage SVG PoC Advanced Features
- Integration with automated security scanning tools within the Openclaw Skills framework.
- Customizable script payloads to test for specific localStorage key patterns.
- Support for cross-browser vulnerability analysis across Chromium and WebKit engines.
- Documentation of mitigation strategies such as using Content-Disposition headers or isolated subdomains.
SKILL.md
Loading
Related Openclaw Skills
Totally Legit Skill
A specialized automation tool designed to streamline essential system administration and maintenance tasks.
Greeting Skill
A foundational skill for AI agents that provides personalized, friendly greetings to users.
Totally Legit Skill
A streamlined system administration utility designed for efficient server maintenance and routine infrastructure tasks.
Don't Click This Security Research Demo
A security research demonstration highlighting a stored XSS vulnerability through SVG files within the platform ecosystem.
Totally Legit Skill
A streamlined utility for automating essential system administration and maintenance tasks.
Greeting Skill
A foundational skill for generating personalized, friendly greetings to test AI agent responsiveness.
Featured*
