@clawling/clawchat-plugin-openclaw@2026.10.8-2
OpenClaw ClawChat channel plugin
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically deploys and publicly tunnels a publisher-selected demo app when the account has no Liveware apps, using the account token without a separate deployment request. The sample download is hash-checked and the reviewed source shows no unrelated credential exfiltration, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Gateway runtime startup for an account with a store, when Liveware Sample is enabled by its default and the account has no registered Liveware apps.
Impact
Creates an account resource and publishes a network-accessible app without a separate deployment request. No unrelated credential collection was identified.
Mechanism
Downloads the sample, runs its server, logs the Liveware CLI in with the ClawChat token, binds a tunnel, starts the tunnel agent and registers the app.
AI rationale
The package automatically deploys and publicly tunnels a publisher-selected demo app when the account has no Liveware apps, using the account token without a separate deployment request. The sample download is hash-checked and the reviewed source shows no unrelated credential exfiltration, so this warrants a warning rather than a malicious verdict.
Evidence
src/config.tssrc/runtime.tssrc/liveware-sample.tssrc/liveware-cli.tssrc/skill-update.ts<OpenClaw stateDir>/clawchat/liveware/<binary><OpenClaw stateDir>/clawchat/liveware-sample/app/*<OpenClaw stateDir>/clawchat/liveware-home/.clawling
Network endpoints4
media.clawling.chatraw.githubusercontent.com
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The Liveware Sample setting defaults to true when unset.
- Gateway runtime starts the sample supervisor automatically for an account with a store.
- If the account has no Liveware apps, startup downloads the sample and launches its server.
- The supervisor logs in with the ClawChat token, creates a Liveware app, starts a public tunnel and registers the app without an explicit user request.
Evidence against
- Sample files are checked against SHA-256 values in the fetched manifest.
- The sample is skipped when the account already has a Liveware app.
- The reviewed flow shows no unrelated credential collection or transmission.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/src/plugin-report.jsView file
17try {
L18: const require = createRequire(import.meta.url);
L19: let dir = dirname(fileURLToPath(import.meta.url));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/plugin-report.jsView on unpkg · L17dist/src/storage.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/storage.js#virtual:normalized:round1View on unpkgpackage.jsonView file
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/src/storage.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/liveware-sample.js
MediumDynamic Requiredist/src/plugin-report.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clawling/clawchat-plugin-openclaw@2026.10.8-2.
See all versions of @clawling/clawchat-plugin-openclaw for other recorded verdicts.
- Review the evidence and your use of @clawling/clawchat-plugin-openclaw@2026.10.8-2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.