@clawling/clawchat-plugin-openclaw@2026.10.13-1
OpenClaw ClawChat channel plugin
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package is not clearly malicious, but its default runtime behavior can create and publicly expose a demo app using the user's account without a separate request. This is an unrequested agent capability, so downgrade to a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A configured ClawChat account starts the runtime; the `livewareSample` setting defaults to enabled.
Impact
An unrequested public demo app and persistent local server/tunnel processes may be created under the user's account.
Mechanism
The plugin downloads the Liveware CLI and sample, logs the CLI in with the ClawChat token, creates an app if needed, binds a tunnel, and registers the app.
AI rationale
The package is not clearly malicious, but its default runtime behavior can create and publicly expose a demo app using the user's account without a separate request. This is an unrequested agent capability, so downgrade to a warning.
Evidence
src/config.tssrc/runtime.tssrc/liveware-sample.tssrc/liveware-cli.ts<stateDir>/clawchat/liveware<stateDir>/clawchat/liveware-home<sampleRoot>/app
Network endpoints3
media.clawling.chatraw.githubusercontent.comapp.clawling.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The `livewareSample` setting defaults to `true` when unset.
- Runtime startup launches the Liveware Sample supervisor without waiting for a user command.
- With a ClawChat token, the supervisor downloads the sample and skips only when the account already has Liveware apps.
- The default flow creates a “Liveware Sample” app, binds a public tunnel, and registers the app with ClawChat.
- The plugin can download a Liveware CLI at startup and mark it executable.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; `prepublishOnly` is a publishing check.
- The sample bootstrap skips when the account already has Liveware apps.
- The sample download checks each file against a SHA-256 value from its manifest.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/src/plugin-report.jsView file
17try {
L18: const require = createRequire(import.meta.url);
L19: let dir = dirname(fileURLToPath(import.meta.url));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/plugin-report.jsView on unpkg · L17dist/src/dm-recall-default.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/dm-recall-default.js#virtual:normalized:round1View on unpkgpackage.json
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/src/dm-recall-default.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/liveware-sample.js
MediumDynamic Requiredist/src/plugin-report.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clawling/clawchat-plugin-openclaw@2026.10.13-1.
See all versions of @clawling/clawchat-plugin-openclaw for other recorded verdicts.
- Review the evidence and your use of @clawling/clawchat-plugin-openclaw@2026.10.13-1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.