@clawling/clawchat-plugin-openclaw@2026.10.8-1
OpenClaw ClawChat channel plugin
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe default startup path passes the account's ClawChat token to a separate Liveware CLI login flow without requiring a user command or opt-in. Under the credential rule, automatically forwarding a service credential to another service without consent is credential exfiltration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Configured gateway startup when `livewareSample` is unset or true and the account has no registered Liveware apps.
Impact
The ClawChat credential is handed to a separate Liveware service as part of an automatic startup flow, creating an unconsented credential disclosure.
Mechanism
The plugin downloads the Liveware CLI, downloads and runs the sample app, then invokes `liveware login --access-token` with the ClawChat token before creating and tunneling an app.
Attack narrative
On gateway startup, the plugin enables the Liveware sample by default. If the account has no registered Liveware apps, it downloads and runs a demo and invokes the Liveware CLI with the account's ClawChat access token. This sends a credential belonging to the ClawChat service to the separate Liveware login flow without an explicit user request. The sample's product purpose and hash checks do not provide consent for forwarding that token.
AI rationale
The default startup path passes the account's ClawChat token to a separate Liveware CLI login flow without requiring a user command or opt-in. Under the credential rule, automatically forwarding a service credential to another service without consent is credential exfiltration.
Evidence
src/config.tssrc/runtime.tssrc/liveware-sample.tssrc/liveware-cli.ts<stateDir>/clawchat/liveware/<liveware binary><stateDir>/clawchat/liveware-sample/app/<stateDir>/clawchat/liveware-home/.clawling
Network endpoints3
app.clawling.commedia.clawling.chat/liveware//clawling/clawchat-plugin-install-cli
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- The Liveware Sample auto-install option defaults to true.
- Gateway startup starts a Liveware supervisor and supplies the account's ClawChat token to it.
- When the account has no Liveware apps, the supervisor downloads the sample and starts its local server.
- The supervisor passes the token to the Liveware CLI as `login --access-token <token>` without a user-run login command.
- The CLI binary is downloaded from the vendor's Liveware host for this automatic flow.
Evidence against
- The flow is presented in source as a Liveware Sample integration, and users can disable it with `livewareSample`.
- Sample files are checked against hashes in the fetched manifest before installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/src/plugin-report.jsView file
17try {
L18: const require = createRequire(import.meta.url);
L19: let dir = dirname(fileURLToPath(import.meta.url));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/plugin-report.jsView on unpkg · L17dist/src/storage.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/storage.js#virtual:normalized:round1View on unpkgpackage.jsonView file
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/src/storage.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/liveware-sample.js
MediumDynamic Requiredist/src/plugin-report.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clawling/clawchat-plugin-openclaw@2026.10.8-1.
See all versions of @clawling/clawchat-plugin-openclaw for other recorded verdicts.
- Avoid installing @clawling/clawchat-plugin-openclaw@2026.10.8-1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.