@clawos-dev/clawd@0.2.678
Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install hook, but its guest-session launcher injects owner Anthropic credentials into a sandboxed guest Claude process without a guest-specific consent gate. This is a concrete agent capability risk, while the inspected source does not establish credential theft or a separate credential recipient.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The daemon creates a Claude session in persona guest scope.
Impact
A guest session can use the owner’s configured Anthropic access, creating potential account or usage exposure.
Mechanism
The launcher reads `~/.claude/settings.json` and merges Anthropic environment values and `apiKeyHelper` into the guest’s launch settings after composing its filesystem sandbox.
AI rationale
The package has no install hook, but its guest-session launcher injects owner Anthropic credentials into a sandboxed guest Claude process without a guest-specific consent gate. This is a concrete agent capability risk, while the inspected source does not establish credential theft or a separate credential recipient.
Evidence
dist/cli.cjs~/.claude/settings.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes the `clawd` CLI; its listed scripts are build, development, and test commands, with no install hook.
- Guest sessions require persona scope and a guest work directory, and the launcher composes guest sandbox settings before creating a Claude session.
- The launcher reads the owner’s `~/.claude/settings.json` and collects string-valued `ANTHROPIC_` environment entries and `apiKeyHelper`.
- For guest Claude sessions, it merges those owner values into the guest launch settings and records that credentials were injected.
- The CLI’s `.claude/projects` match is a transcript helper that appends a `turn_duration` system row at turn end when a transcript exists.
- The three App Builder matches point to the bundled `app-builder-projects` skill’s `collect-files.mjs` path, used by the publish flow to verify project files.
Evidence against
- The guest launcher enables filesystem sandboxing and disallows unsandboxed commands, but those controls do not remove the owner credentials merged into guest settings.
Behavioral surface
ChildProcess
Source & flagged code
14 flagged · loading sourcedist/app-builder-plugin/mcp-server.cjsView file
30858var import_node_fs = require("fs");
L30859: var import_node_child_process = require("child_process");
L30860: var import_node_path = require("path");
High
Child Process
Package source references child process execution.
dist/app-builder-plugin/mcp-server.cjsView on unpkg · L30858•matchType = normalized_sha256
matchedPackage = @clawos-dev/clawd@0.2.549
matchedPath = dist/app-builder-plugin/mcp-server.cjs
matchedIdentity = npm:QGNsYXdvcy1kZXYvY2xhd2Q:0.2.549
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/app-builder-plugin/mcp-server.cjsView on unpkg9420if (typeof callback !== "function") {
L9421: callback = new Function("" + callback);
L9422: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/app-builder-plugin/mcp-server.cjsFindings
1 Critical10 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.cjs
HighChild Processdist/app-builder-plugin/mcp-server.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighCommand Output Exfiltrationdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
HighKnown Malware Source Similaritydist/pi-mcp-bridge/extension.cjs
HighKnown Malware Source Similaritydist/app-builder-plugin/mcp-server.cjs
HighKnown Malware Source Similaritydist/dispatch/mcp-server.cjs
HighKnown Malware Source Similaritydist/persona-defaults/persona-app-builder/mcp/clawd-app-builder/mcp-server.cjs
Affected versions and remediation
This report applies to @clawos-dev/clawd@0.2.678.
See all versions of @clawos-dev/clawd for other recorded verdicts.
- Review the evidence and your use of @clawos-dev/clawd@0.2.678 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.