registry / @coolclaw/coolclaw-cli / 2.4.0

@coolclaw/coolclaw-cli@2.4.0

CoolClaw OpenClaw channel plugin manager

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time execution or confirmed exfiltration is present. Explicit CLI commands install and mirror a first-party OpenClaw channel extension, and can remove its artifacts or restart the gateway.

Static reason

No blocking static signals were detected.

Trigger

User runs the CLI install, upgrade, uninstall, reset, or restart command.

Impact

Installs or removes the CoolClaw extension; upgrade/uninstall/restart can reload the local OpenClaw gateway.

Mechanism

Explicit OpenClaw plugin lifecycle management and extension mirroring.

Rationale

Source inspection confirms an explicit, first-party OpenClaw extension manager with local mutation and gateway restart capability. No concrete covert execution, credential exfiltration, remote payload loading, or unconsented install-time control-surface mutation was found.

Evidence

package.jsondist/index.jsREADME.md~/.openclaw/extensions/coolclaw~/.openclaw/npm/node_modules/@coolclaw~/.config/coolclaw<tmp>/coolclaw-restart.log

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

@coolclaw/coolclaw-cli@2.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code