@clawos-dev/clawd@0.2.558
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 23d ago · by lpm-firewall-aiThe explicit setup operation executes remote shell content with local permissions, supporting a dangerous-capability warning. Its guarded activation and package-aligned endpoint do not support a malware verdict or publication block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An administrator invokes engine:connectPool with an API key while Codex is available.
Impact
The remote script can execute with the daemon user's permissions and access its environment; its actual payload is outside this snapshot.
Mechanism
The daemon fetches /api/setup.sh from the ClawOS portal and feeds it to Bash, inheriting the process environment and adding the supplied key.
AI rationale
The explicit setup operation executes remote shell content with local permissions, supporting a dangerous-capability warning. Its guarded activation and package-aligned endpoint do not support a malware verdict or publication block.
Evidence
dist/cli.cjs
Network endpoints1
cpa-portal-d417.app.clawos.chat
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The active daemon registers an account-pool setup handler that accepts a caller-supplied API key.
- Setup downloads a shell script from the package-aligned ClawOS portal.
- The downloaded script is passed to Bash with the daemon environment and supplied API key.
- The setup method requires administrator permission.
Evidence against
- package.json has no npm install lifecycle hooks or runtime self-dependency.
- The flagged agent integration locations define deployment evidence records rather than agent configuration writes.
- The inspected behavior is explicit setup; no covert execution or credential theft was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
19 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
21117var import_node_fs = require("fs");
L21118: var import_node_child_process = require("child_process");
L21119: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L21117•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg24908patternName = generic_password
severity = medium
line = 24908
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L24908Findings
1 Critical15 High5 Medium5 Low
CriticalRemote Response Code Executiondist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
HighKnown Malware Source Similaritydist/persona-defaults/persona-dataclaw-builder/mcp/clawd-app-builder/deploy-kit/scripts/publish.sh
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.558.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.558 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.