registry / @alfe.ai/openclaw-sync / 0.1.10

@alfe.ai/openclaw-sync@0.1.10

AlfeSync — agent workspace backup and sync skill for OpenClaw

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package is an OpenClaw workspace sync plugin/CLI that uploads and restores workspace files through Alfe APIs and presigned URLs. No confirmed malware or decoded remote execution was found, but remote/path-controlled restore and relay delete paths lack clear containment in core download/delete flows.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

OpenClaw plugin startup/hooks, realtime watcher events, sync relay notifications, or user invoking alfesync pull/restore/push.

Impact

Potential workspace data exposure by design and path traversal/destructive overwrite risk if the trusted sync API or relay supplies malicious file paths.

Mechanism

agent workspace cloud sync with remote-directed file write/delete paths

Attack narrative

On OpenClaw startup the plugin can register a service, start a watcher, push changed workspace files to Alfe/S3, pull remote files back, and process WebSocket relay notifications. The observed behavior matches the package purpose, but several remote-file operations write or delete paths formed with join(workspacePath, remotePath) without robust containment checks, creating a serious trust-boundary risk rather than confirmed malicious intent.

Rationale

Static source inspection does not confirm malicious behavior or remote code execution; the risky primitives are package-aligned sync features. However automatic agent-workspace sync plus remote-directed write/delete paths without consistent traversal protection warrants a warning instead of clean.

Evidence

package.jsonopenclaw.plugin.jsondist/plugin2.jsdist/sync-engine.jsdist/cli/index.jsdist/index.js<workspacePath>/**<workspacePath>/shared/**~/.alfe/sync/manifest.json

Network endpoints4

wss://sync.dev.alfe.ai/wswss://sync.demo.alfe.ai/wswss://sync.test.alfe.ai/wswss://sync.alfe.ai/ws

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

openclaw.plugin.json activates onStartup and hooks agent start/stop/compaction to pull/push workspace data
dist/plugin2.js activate() starts realtime watcher and performs initial syncEngine.push() when configured
dist/sync-engine.js uploads changed workspace files via presigned PUT and downloads remote files to disk
dist/sync-engine.js and dist/cli/index.js join remote file paths to workspacePath without containment checks in restore/download paths
dist/plugin2.js relay FILE_CHANGED deleted events can call removeLocalFile(filePath) from WebSocket messages

Evidence against

No npm install/postinstall lifecycle scripts in package.json
No eval/Function/vm or remote asset decode/execute found; scanner critical finding appears to confuse downloads with execution
Network behavior is aligned with declared Alfe/OpenClaw sync and backup functionality
Default ignores exclude .env, .git, node_modules, caches, logs, and common build artifacts
Shared sync code includes containment checks for shared scope downloads

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 10 file(s), 125 KB of source

Source & flagged code

2 flagged

dist/plugin2.jsView file

Lines 87-127javascript

87const MAX_SHARED_FILE_SIZE = 100 * 1024 * 1024;

88/** Throw if `resolvedPath` would escape `baseDir`. */

89function assertContained(baseDir, resolvedPath) {

90 const normalizedBase = normalize(baseDir) + sep;

91 const normalizedPath = normalize(resolvedPath);

92 if (!normalizedPath.startsWith(normalizedBase) && normalizedPath !== normalize(baseDir)) throw new Error(`Path traversal blocked: ${resolvedPath} escapes ${baseDir}`);

93}

94function createSharedSyncEngine(config, log) {

95 let activeScopes = [];

96 const sharedDir = join(config.workspacePath, "shared");

97 function scopeDir(scope) {

98 if (scope.scopeType === "org") return join(sharedDir, "org");

99 return join(sharedDir, scope.scopeType === "team" ? "teams" : "projects", scope.scopeId);

100 }

101 async function downloadFile(scope, filePath, localPath) {

102 assertContained(scopeDir(scope), localPath);

103 const { downloadUrl } = await config.client.sharedDownloadUrl({

104 scope: scope.scopeType,

105 scopeId: scope.scopeId,

106 filePath

107 });

108 const response = await fetch(downloadUrl);

109 if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`);

110 const contentLength = parseInt(response.headers.get("content-length") ?? "0", 10);

111 if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`);

112 const buffer = Buffer.from(await response.arrayBuffer());

113 if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

114 await mkdir(dirname(localPath), { recursive: true });

115 await writeFile(localPath, buffer);

116 }

117 async function syncScope(scope) {

118 const dir = scopeDir(scope);

119 await mkdir(dir, { recursive: true });

120 try {

121 const { files } = await config.client.sharedListFiles({

122 scope: scope.scopeType,

123 scopeId: scope.scopeId

124 });

125 for (const file of files) {

126 const localPath = join(dir, file.filePath);

127 try {

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/plugin2.jsView file

107}); L108: const response = await fetch(downloadUrl); L109: if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`); ... L111: if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`); L112: const buffer = Buffer.from(await response.arrayBuffer()); L113: if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`); ... L296: */ L297: const pkg = createRequire(import.meta.url)("../package.json"); L298: const SYNC_CAPABILITIES = [ ... L472: syncRelayReconnectAttempt = 0; L473: ws.send(JSON.stringify({ L474: type: "SUBSCRIBE",

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg

Findings

2 Critical1 High2 Medium4 Low

CriticalRemote Asset Decode Executedist/plugin2.js

CriticalTrigger Reachable Dangerous Capabilitydist/plugin2.js

HighChild Process

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

dist/plugin2.jsView file

Lines 87-127javascript

87const MAX_SHARED_FILE_SIZE = 100 * 1024 * 1024;

88/** Throw if `resolvedPath` would escape `baseDir`. */

89function assertContained(baseDir, resolvedPath) {

90 const normalizedBase = normalize(baseDir) + sep;

91 const normalizedPath = normalize(resolvedPath);

92 if (!normalizedPath.startsWith(normalizedBase) && normalizedPath !== normalize(baseDir)) throw new Error(`Path traversal blocked: ${resolvedPath} escapes ${baseDir}`);

93}

94function createSharedSyncEngine(config, log) {

95 let activeScopes = [];

96 const sharedDir = join(config.workspacePath, "shared");

97 function scopeDir(scope) {

98 if (scope.scopeType === "org") return join(sharedDir, "org");

99 return join(sharedDir, scope.scopeType === "team" ? "teams" : "projects", scope.scopeId);

100 }

101 async function downloadFile(scope, filePath, localPath) {

102 assertContained(scopeDir(scope), localPath);

103 const { downloadUrl } = await config.client.sharedDownloadUrl({

104 scope: scope.scopeType,

105 scopeId: scope.scopeId,

106 filePath

107 });

108 const response = await fetch(downloadUrl);

109 if (!response.ok) throw new Error(`Download failed: HTTP ${String(response.status)}`);

110 const contentLength = parseInt(response.headers.get("content-length") ?? "0", 10);

111 if (contentLength > MAX_SHARED_FILE_SIZE) throw new Error(`File too large: ${String(contentLength)} bytes exceeds ${String(MAX_SHARED_FILE_SIZE)} limit`);

112 const buffer = Buffer.from(await response.arrayBuffer());

113 if (buffer.length > MAX_SHARED_FILE_SIZE) throw new Error(`Downloaded file exceeds size limit: ${String(buffer.length)} bytes`);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/plugin2.jsView on unpkg · L107

114 await mkdir(dirname(localPath), { recursive: true });

115 await writeFile(localPath, buffer);

116 }

117 async function syncScope(scope) {

118 const dir = scopeDir(scope);

119 await mkdir(dir, { recursive: true });

120 try {

121 const { files } = await config.client.sharedListFiles({

122 scope: scope.scopeType,

123 scopeId: scope.scopeId

124 });

125 for (const file of files) {

126 const localPath = join(dir, file.filePath);

127 try {

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/plugin2.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin2.jsView on unpkg