@clawling/clawchat-plugin-openclaw@2026.10.9-1
OpenClaw ClawChat channel plugin
AI Security Review
scanned 2d ago · by lpm-firewall-aiNo concrete malicious behavior was identified, and the sample and CLI are fetched from the plugin’s stated service sources. However, the default startup path can execute and publicly expose a sample app under the user’s account without an explicit deployment request, so this warrants a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the gateway with configured ClawChat credentials; the sample setting defaults to enabled.
Impact
A remote sample is executed and exposed through a tunnel under the user’s account without an explicit per-deployment request.
Mechanism
The plugin fetches a sample and Liveware CLI, launches the sample server, binds a Liveware tunnel, and registers the app when the account has no existing apps.
AI rationale
No concrete malicious behavior was identified, and the sample and CLI are fetched from the plugin’s stated service sources. However, the default startup path can execute and publicly expose a sample app under the user’s account without an explicit deployment request, so this warrants a warning.
Evidence
dist/src/config.jsdist/src/runtime.jsdist/src/liveware-sample.jsdist/src/liveware-cli.js<stateDir>/clawchat/liveware/<stateDir>/clawchat/liveware-sample/OpenClaw gateway config file
Network endpoints2
media.clawling.chat/liveware/raw.githubusercontent.com/clawling/clawchat-plugin-install-cli
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The `livewareSample` setting defaults to `true` when unset.
- Gateway startup creates a Liveware sample supervisor and starts it automatically.
- When the account has no Liveware apps, the supervisor downloads the sample and launches its server.
- The supervisor binds a tunnel and registers the sample as a ClawChat app.
- The Liveware CLI download comes from `media.clawling.chat`.
- The plugin also writes `rememberAcrossConversations: false` only when that setting is unset, preserving explicit choices.
Evidence against
- The sample bootstrap skips accounts that already have Liveware apps.
- The sample feature can be disabled with the `livewareSample` setting.
- The sample is downloaded from the configured official install-CLI source and its files are checked against manifest SHA-256 values.
- The package has no preinstall, install, or postinstall hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
4 flaggeddist/src/plugin-report.jsView file
17try {
L18: const require = createRequire(import.meta.url);
L19: let dir = dirname(fileURLToPath(import.meta.url));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/src/plugin-report.jsView on unpkg · L17dist/src/dm-recall-default.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/src/dm-recall-default.js#virtual:normalized:round1View on unpkgpackage.json
Findings
1 Critical2 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limiteddist/src/dm-recall-default.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/src/liveware-sample.js
MediumDynamic Requiredist/src/plugin-report.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @clawling/clawchat-plugin-openclaw@2026.10.9-1.
See all versions of @clawling/clawchat-plugin-openclaw for other recorded verdicts.
- Review the evidence and your use of @clawling/clawchat-plugin-openclaw@2026.10.9-1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.