Loading npm security reports…

@clawd-bot/clawd@1.0.6: AI-agent control-surface risk | LPM Firewall

registry / @clawd-bot/clawd / 1.0.6

@clawd-bot/clawd@1.0.6

Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack, Skill Hub (train2earn + skillhub-main), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs code that installs bundled skills and links them into several unrelated AI-agent skill directories. This changes the behavior available to those agent hosts without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, including a transitive installation that permits lifecycle scripts.

Impact

Bundled skill instructions become active through Agents, Claude, and Codex control surfaces.

Mechanism

Automatic copying and forced symlink creation in foreign agent skill roots.

Policy narrative

On installation, npm invokes the package postinstall hook. Unless an opt-out variable is set, that hook copies the bundled skill tree into the user home and force-links every skill into the skill directories used by multiple AI-agent products. This is an unconsented lifecycle mutation of broad third-party agent control surfaces. The same lifecycle code may also launch a bounded connection to the package's WebSocket relay for an install display.

Rationale

The lifecycle hook automatically modifies broad foreign AI-agent skill roots, satisfying the package firewall rule for an unconsented postinstall control-surface mutation. No credential exfiltration was confirmed, but that does not remove the concrete install-time hijack behavior.

Evidence

package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjsscripts/pump-tape.mjsskills~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

76"scripts": { "oneshot": "node scripts/oneshot-install.mjs", "install:stack": "node scripts/oneshot-install.mjs", "postinstall": "node scripts/postinstall.mjs", "skills:list": "node -e \"import('./scripts/sk[redacted]').then(m=>console.log(m.listSkillIds().join('\\n')))\""

High

Suspicious Lifecycle Evidence

The package declares a postinstall lifecycle hook that runs automatically during npm installation.

package.jsonView on unpkg · L76

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/oneshot-install.mjsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Write operation from scripts/oneshot-install.mjs: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Foreign user/project scop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/oneshot-install.mjsView on unpkg · L5

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 56-92json

56 "bin/clawdbot-go.js",

57 "bin/clawdbot-go.mjs",

58 "scripts/oneshot-install.mjs",

59 "scripts/skill-pack.mjs",

60 "scripts/postinstall.mjs",

61 "scripts/pump-tape.mjs",

62 "install-npm.sh",

63 "install.sh",

64 "skills",

65 "automaton-main/package.json",

66 "automaton-main/README.md",

67 "automaton-main/src",

68 "automaton-main/scripts",

69 "automaton-main/constitution.md",

70 "automaton-main/LICENSE",

71 "docs/RH_CRYPTO_AGENT_STACK.md",

72 "README.md",

73 "LICENSE",

74 "AGENTS.md"

75 ],

76 "scripts": {

77 "oneshot": "node scripts/oneshot-install.mjs",

78 "install:stack": "node scripts/oneshot-install.mjs",

79 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "skills:list": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

The package declares a postinstall lifecycle hook that runs automatically during npm installation.

package.jsonView on unpkg · L76

81 "skills:inspect": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(JSON.stringify(m.inspectPack(),null,2)))\"",

82 "test:oneshot": "node --test scripts/oneshot-install.test.mjs scripts/pump-tape.test.mjs",

83 "test:branding": "node --test scripts/branding-check.mjs",

84 "test:docs": "node --test scripts/docs-check.mjs",

85 "check": "node --check bin/clawdbot-go.mjs && node --check scripts/oneshot-install.mjs && node --check scripts/skill-pack.mjs && node --check scripts/postinstall.mjs && node --check scripts/pump-tape.mjs && npm run test:oneshot && npm run test:branding && npm run test:docs"

86 },

87 "preferGlobal": true,

88 "dependencies": {

89 "cheshire-terminal-agents": "^1.48.4"

90 }

91}

92

scripts/oneshot-install.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Clawd — one-shot stack installer (Grok Build style).

4 *

5 * Installs:

6 * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills

7 * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks

8 * • Optional: Go clawdbot binary, automaton-main deps, birth skill seeds

9 *

10 * Usage:

11 * npm i -g clawd-go

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg