by agentkernel
OpenClaw Desktop – One-click .exe Windows installer & native desktop app for the OpenClaw AI agent framework. Run, update, and manage OpenClaw locally with ease. | 龙虾智能体官方中文桌面版一键安装部署EXE程序
# Add to your Claude Code skills
git clone https://github.com/agentkernel/openclaw-desktopGuides for using ai agents skills like openclaw-desktop.
Last scanned: 8/8/2026
{
"issues": [
{
"type": "npm-audit",
"message": "adm-zip: adm-zip: Crafted ZIP file triggers 4GB memory allocation",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session",
"severity": "high"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "form-data: form-data uses unsafe random function in form-data for choosing boundary",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "image-size: image-size: ICNS parser allows denial of service through an infinite loop",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jimp: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "jpeg-js: Infinite loop in jpeg-js",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimist: Prototype Pollution in minimist",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "mkdirp: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "request: Server-Side Request Forgery in Request",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "resize-img: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
"severity": "high"
},
{
"type": "npm-audit",
"message": "to-ico: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tough-cookie: tough-cookie Prototype Pollution vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "url-regex: Regular expression denial of service in url-regex",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "xlsx: Prototype Pollution in sheetJS",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-08-08T04:56:29.457Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}openclaw-desktop is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by agentkernel. OpenClaw Desktop – One-click .exe Windows installer & native desktop app for the OpenClaw AI agent framework. Run, update, and manage OpenClaw locally with ease. | 龙虾智能体官方中文桌面版一键安装部署EXE程序. It has 100 GitHub stars.
openclaw-desktop failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/agentkernel/openclaw-desktop" and add it to your Claude Code skills directory (see the Installation section above).
openclaw-desktop is primarily written in TypeScript. It is open-source under agentkernel on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh openclaw-desktop against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Language: English · 简体中文
OpenClaw Desktop packages the OpenClaw runtime into a standard Windows install experience. Download one .exe, finish a setup wizard, and run OpenClaw from a native desktop shell — no manual wiring, no terminal required.
If you've been searching for how to install OpenClaw on Windows, how to run OpenClaw locally, or an OpenClaw Windows installer with a GUI, this is it.
package.json, e.g. OpenClaw-Setup-0.7.0+openclaw.2026.4.2.exe)System: Windows 10/11 x64 · ~350 MB free space · Internet for API calls
0.7.0+openclaw.2026.4.2 (semver + bundled OpenClaw pin in build metadata).v0.7.0+openclaw.2026.4.2 — same as package.json version with a v prefix (OpenClaw pin visible in the tag).npm install openclaw@2026.4.2 (current npm latest); pinned in package.json as openclawBundleVersion.allowedOrigins: ["*"] when unset on loopback, wizard loopback parity, amazon-bedrock stripped from the installer). v0.6.3 merged iframe auth flags on read/write + write retries (0.6.3). v0.6.2 documents Git tags with bundled OpenClaw (0.6.2). Feishu registerFull guard; MiniMax M2.7-only; Control UI from GitHub tag sources for Electron.Full notes: openclaw/openclaw v2026.4.2 · npm release digest.
Breaking (this bump)
x_search settings from legacy core tools.web.x_search.* to plugin-owned plugins.entries.xai.config.xSearch.*; standardize auth on plugins.entries.xai.config.webSearch.apiKey / XAI_API_KEY. Migrate with openclaw doctor --fix (#59674).web_fetch config from tools.web.fetch.firecrawl.* to plugins.entries.firecrawl.config.webFetch.*. Migrate with openclaw doctor --fix (#59465).Notable for desktop / loopback users (fixes in this train)
operator.admin so sessions_spawn no longer fails loopback scope-upgrade pairing (#59555).Still in effect from earlier pins (e.g. 2026.3.31)
nodes.run shell wrapper; use exec host=node and nodes invoke where appropriate.openclaw/plugin-sdk/*; legacy shims are deprecated.hooks.mappings[].channel accepts runtime plugin ids such as feishu (#56226).Tip (MiniMax 401): MiniMax Anthropic-compatible endpoints expect x-api-key, not Bearer. This shell sets authHeader: false for MiniMax and migrates existing configs on load. Other third-party anthropic-messages hosts may still need authHeader: true where documented.
Older desktop releases are listed in CHANGELOG.md.
2026.4.2)Each release pins the bundled OpenClaw npm version in root package.json (openclawBundleVersion). pnpm run download-openclaw installs that exact version (unless you override with a CLI arg or OPENCLAW_DESKTOP_BUNDLE_VERSION). For local packaging, run download-openclaw before prepare-bundle. The committed resources/bundle-manifest.json is informational only — the bundled version is whatever prepare-bundle writes to bundledOpenClawVersion.
pnpm run download-node), matching upstream openclaw.mjs / engines (Node ≥ 22.16).%USERPROFILE%\.openclaw, main config openclaw.json. Use OPENCLAW_* env vars (CLAWDBOT_* / MOLTBOT_*, .moltbot, etc. were removed upstream).dist/control-ui/; we fetch GitHub tag v<version> sources (ui/ plus repo-root src/, etc.) and run Vite. CI builds static assets on Linux and merges them into the Windows installer.remote), the shell auto-maintains gateway.controlUi.allowInsecureAuth and dangerouslyDisableDeviceAuth in openclaw.json so OpenClaw 2026.3.x Control UI works inside the Electron iframe (see CHANGELOG 0.6.1). If you switch to remote gateway or hand-edit these keys, follow upstream docs.dist/extensions/*; the desktop shell scans that path and still falls back to legacy top-level extensions/.openclaw/plugin-sdk/*), browser/install behavior, and other breaking items are covered in upstream OpenClaw releases and upstream docs for the version you ship. Installer-only users usually need no action; custom/third-party plugin authors should follow upstream migration guides.Same section in Chinese: README.zh-CN.md.
| 🔽 One-click installer | Native Windows .exe installer — no npm install or system-wide Node.js needed |
| ⚡ Bundled runtime | Ships with portable Node.js + OpenClaw so first launch is instant |
| 🧙 Guided setup wizard | Step-by-step configuration for model provider, channel, and gateway |
| 🔄 In-app updates | Built-in updater via GitHub Releases; rollback to any previous version |
| 🪟 Native Windows shell | Start Menu, Desktop shortcut, system tray, and auto-start support |
| 🌐 50+ providers | OpenAI, Claude, Gemini, DeepSeek, Kuae, and more |
| 💬 Multi-channel | Telegram, Discord, Slack, WhatsApp, Feishu, and more |
| 🌍 Multi-language UI | English, 简体中文, 繁體中文, 日本語, 한국어, Español, Français |
| 🔐 Feishu pairing & allowlist | Approve DM users, manage senders, add open_id — all inside the app |
OpenClaw
|
┌────────┴────────┐
│ │
Desktop GUI
│ Plugins
Installer ...
OpenClaw Desktop is a community-maintained Windows distribution for the OpenClaw ecosystem. Part of the OpenClaw ecosystem — not affiliated with the core project.
| Release tag | v0.7.0+openclaw.2026.4.2 (equals v + package.json version) |
| Installer | OpenClaw-Setup-0.7.0+openclaw.2026.4.2.exe (see Releases for exact asset) |
| Platform | Windows 10/11 x64 |
| Includes | Electron shell, portable Node.js, bundled OpenClaw |
| Extras | SHA-256 c |