registry / @aiyiran/myclaw / 1.1.186

@aiyiran/myclaw@1.1.186

⚠ Under review

为 OpenClaw 教学环境设计的一站式命令行工具。

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 665 KB of source, external domains: 127.0.0.1, api.b.ai, api.minimaxi.com, api.tavily.com, api.vveai.com, cdn.yiranlaoshi.com, mirrors.aliyun.com, open.bigmodel.cn, openclaw.ai, registry.npmjs.org, registry.npmmirror.com, tavily.com, view.officeapps.live.com, www.apple.com, www.google.cn, www.google.com, www.w3.org, www.yiranlaoshi.com, x.x.x.x

Source & flagged code

8 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 if (process.platform === 'win32' || fs.existsSync('/root/.openclaw')) {

31 return '/root/.openclaw';

32 }

33 return path.join(os.homedir(), '.openclaw');

34}

36// ─────────────────────────────────────────────

37// listAllAgents

38// ─────────────────────────────────────────────

40/**

41 * 返回所有 Agent 的信息列表（JSON注册表 ∪ agents文件夹）。

42 *

Lines 151-191javascript

151

152 // ── macOS ──

153 if (plat === 'darwin') {

154 const trashDir = path.join(os.homedir(), '.Trash');

155 const base = path.basename(p);

156 let dest = path.

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

12 * Windows 支持说明:

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Source & flagged code

8 flagged · loading source

delete_agents.jsView file

22const os = require('os'); L23: const { spawnSync, execSync } = require('child_process'); L24:

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

171const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`; L172: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 }); L173: if (ret.status === 0) return { ok: true, method: 'powershell' };

High

Shell

Package source references shell execution.

delete_agents.jsView on unpkg · L171

19L20: const fs = require('fs'); L21: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

index.jsView file

1603console.log(' ' + colors.dim + '→ 正在打开浏览器...' + colors.nc); L1604: const { exec } = require('child_process'); L1605: const fs = require('fs'); L1606: const machineUrl = 'https://' + selected.claw + '.kekouen.cn?token=aiyiran'; L1607: const platform = os.platform(); ... L1611: const chromeCandidates = [ L1612: path.join(process.env.PROGRAMFILES || 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'), L1613: path.join(process.env['PROGRAMFILES(X86)'] || 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L1603

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

14* - Windows 7/8/10 旧版本: 颜色代码会被 stripped，避免乱码 L15: * - 推荐 Windows 用户使用 Windows Terminal 或 PowerShell 7+ 获得最佳体验 L16: * - Emoji 符号在 Windows 命令行可能显示为方块，属正常现象 ... L30: const { createAgent } = require('./create_agent'); L31: const { version } = require(path.join(__dirname, 'package.json')); L32: const { TOKEN, DEFAULT_URL } = require(path.join(__dirname, 'config')); ... L81: console.log('[Windows] 检测到 Windows 系统，正在安装...'); L82: const cmd = 'powershell -c "irm https://openclaw.ai/install.ps1 | iex"'; L83: console.log('> ' + cmd); ... L165: stdio: 'inherit', L166: env: { ...process.env, npm[redacted]: 'true' } L167: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L14

163try { L164: execSync('npm install -g openclaw@' + targetVersion, { L165: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L163

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Findings

2 Critical4 High5 Medium4 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processdelete_agents.js

HighShelldelete_agents.js

HighSandbox Evasion Gated Capabilityindex.js

HighRuntime Package Installindex.js

MediumDynamic Requiredelete_agents.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpublish.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

delete_agents.jsView file

Lines 1-42javascript

1/**

2 * ============================================================================

3 * MyClaw — delete_agents 核心模块

4 * ============================================================================

5 *

6 * 提供 Agent 批量删除的底层能力，被以下两处复用：

7 * 1. CLI：mc delete (交互式批量删除)

8 * 2. API：sync_workspace.py /api/agents /api/agents/trash

9 *

10 * 导出：

11 * listAllAgents() → 取 JSON注册 ∪ agents文件夹的并集，附统计信息

12 * trashPath(p) → 跨平台移入回收站（macOS/Windows/Linux）

13 * deleteRegisteredAgent(id)→ 调用 openclaw agents delete --force

14 * deleteOrphanAgent(ag) → 对孤立 agent 的所有路径执行 trashPath

15 * ============================================================================

16 */

18'use strict';

20const fs = require('fs');

21const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

delete_agents.jsView on unpkg · L19

22const os = require('os');

23const { spawnSync, execSync } = require('child_process');

High

Child Process

Package source references child process execution.

delete_agents.jsView on unpkg · L22

25// ─────────────────────────────────────────────

26// 路径工具

27// ─────────────────────────────────────────────

29function getOpenclawDir() {

30 if (process.platform === 'win32' || fs.existsSync('/root/.openclaw')) {

31 return '/root/.openclaw';

32 }

33 return path.join(os.homedir(), '.openclaw');

34}

36// ─────────────────────────────────────────────

37// listAllAgents

38// ─────────────────────────────────────────────

40/**

41 * 返回所有 Agent 的信息列表（JSON注册表 ∪ agents文件夹）。

42 *

Lines 151-191javascript

151

152 // ── macOS ──

153 if (plat === 'darwin') {

154 const trashDir = path.join(os.homedir(), '.Trash');

155 const base = path.basename(p);

156 let dest = path.

index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ============================================================================

5 * MyClaw - 学生友好的 OpenClaw 工具

6 * ============================================================================

7 *

8 * 跨平台要求 / Cross-Platform Requirements:

9 * ----------------------------------------

10 * 本脚本支持 macOS、Linux 和 Windows。

11 *

12 * Windows 支持说明:

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

Lines 1583-1623javascript

1583const MACHINE_ZERO = { name: '依然', claw: 'claw', desc: '依然的机器' };

1584

1585const MACHINE_CONFIG = [

1586 { name: 'kendy', claw: 'claw1', desc: 'kendy 的机器' },

1587 { name: 'Ethan', claw: 'claw2', desc: 'Ethan 的机器' },

1588 { name: 'HENRY', claw: 'claw3', desc: 'HENRY 的机器' },

1589 { name: 'Mo靖宇', claw: 'claw4', desc: 'Mo靖宇的机器' },

1590 { name: '高兴', claw: 'claw5', desc: '高兴的机器' },

1591 { name: '伊伊', claw: 'claw6', desc: '伊伊的机器' },

1592 { name: '梓浩', claw: 'claw7', desc: '梓浩的机器' },

1593 { name: '刘泓毅', claw: 'claw8', desc: '刘泓毅的机器' },

1594 { name: 'Mia', claw: 'claw9', desc: 'Mia 的机器' },

1595 { name: '雨熙', claw: 'claw10', desc: '雨熙的机器' },

1596 { name: '绍博', claw: 'claw11', desc: '绍博的机器' },

1597 { name: '黄玺澄', claw: 'claw12', desc: '玺澄的机器' },

1598];

1599

1600function openMachine(selected) {

1601 console.log('');

1602 console.log(colors.green + ' → 已选择: ' + selected.name + ' (' + selected.claw + ')' + colors.nc);

1603 console.log(' ' + colors.dim + '→ 正在打开浏览器...' + colors.nc);

1604 const { exec } = require('child_process');

1605 const fs = require('fs');

1606 const machineUrl = 'https://' + selected.claw + '.kekouen.cn?token=aiyiran';

1607 const platform = os.platform();

1608 if (platform === 'darwin') {

1609 exec('open -a "Google Chrome" "' + machineUrl + '"');

1610 } else if (platform === 'win32') {

1611 const chromeCandidates = [

1612 path.join(process.env.PROGRAMFILES || 'C:\\Program Files', 'Google', 'Chrome', 'Application', 'chrome.exe'),

1613 path.join(process.env['PROGRAMFILES(X86)'] || 'C:\\Program Files (x86)', 'Google', 'Chrome', 'Application', 'chrome.exe'),

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L1603

1614 path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'Google', 'Chrome', 'Application', 'chrome.exe'),

1615 ];

1616 const chromePath = chromeCandidates.find(function (p) { try { return fs.existsSync(p); } catch { return false; } });

1617 if (chromePath) {

1618 exec('"' + chromePath + '" "' + machineUrl + '"');

1619 } else {

1620 exec('start "" "' + machineUrl + '"', { shell: true });

1621 }

1622 } else {

1623 exec('xdg-open "' + machineUrl + '"');