@aiyiran/myclaw@1.1.204
为 OpenClaw 教学环境设计的一站式命令行工具。
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThere is no install lifecycle hook, but explicit CLI flows establish persistent third-party workspace uploads and broad modification of a foreign AI-agent UI. The behavior is risky and insufficiently constrained, though static source does not establish automatic install-time malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The user runs myclaw server, sync, patch, up, all, or init.
Impact
Workspace contents can be disclosed to the CDN, and the altered control UI has a wider network and framing attack surface.
Mechanism
Persistent workspace upload plus foreign control-UI script injection and CSP weakening.
AI rationale
There is no install lifecycle hook, but explicit CLI flows establish persistent third-party workspace uploads and broad modification of a foreign AI-agent UI. The behavior is risky and insufficiently constrained, though static source does not establish automatic install-time malware.
Evidence
server/sync_workspace.pypatches/patch.jsindex.js~/.openclaw/workspace*OpenClaw dist/control-ui/index.htmlOpenClaw dist/*.js
Network endpoints1
cdn.yiranlaoshi.com
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with low false-positive risk.
Evidence for warning
- The server continuously uploads changed OpenClaw workspace files to a third-party CDN.
- The patch command injects several scripts into another package's control UI and weakens its CSP to allow arbitrary connections and frames.
- The persistent upload server is started by a CLI command and scans workspace directories.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The risky actions require explicit CLI commands; package import alone does not run them.
- No self-dependency or automatic registry-install lifecycle chain is present.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
20 flagged · loading sourcedelete_agents.jsView file
22const os = require('os');
L23: const { spawnSync, execSync } = require('child_process');
L24:
High
173const psCmd = `Add-Type -AssemblyName Microsoft.VisualBasic; [Microsoft.VisualBasic.FileIO.FileSystem]::${method}(${extraArgs})`;
L174: const ret = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 15000 });
L175: if (ret.status === 0) return { ok: true, method: 'powershell' };
High
19L20: const fs = require('fs');
L21: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
delete_agents.jsView on unpkg · L19index.jsView file
Findings
3 Critical15 High5 Medium4 Low
CriticalSame File Env Network Executionindex.js
CriticalDownload Executeprepare.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processdelete_agents.js
HighShelldelete_agents.js
HighSandbox Evasion Gated Capabilityindex.js
HighRuntime Package Installindex.js
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similarityprepare.js
HighKnown Malware Source Similaritygateway.js
HighKnown Malware Source Similaritylaunch.js
Affected versions and remediation
This report applies to @aiyiran/myclaw@1.1.204.
See all versions of @aiyiran/myclaw for other recorded verdicts.
- Review the evidence and your use of @aiyiran/myclaw@1.1.204 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.