registry / @haaaiawd/second-nature / 0.2.14

@haaaiawd/second-nature@0.2.14

OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An on-startup OpenClaw extension exposes an agent-facing setup flow that returns guidance intended for long-lived agent anchors. A subsequent explicit tool command persists only an acknowledgement marker.

Static reason

No blocking static signals were detected.

Trigger

OpenClaw startup; then second_nature_ops setup_hint/setup_ack with a workspace root.

Impact

Can influence an agent if an operator follows the supplied guidance; no unconsented foreign control-surface write is implemented.

Mechanism

first-party agent-extension setup and workspace runtime bridge

Rationale

Source shows a first-party OpenClaw setup/control surface with persistent agent-guidance intent, but no lifecycle hook, fixed exfiltration endpoint, or unconsented foreign-agent mutation. Warn under the extension-lifecycle policy rather than block.

Evidence

package.jsonopenclaw.plugin.jsonindex.jsworkspace-ops-bridge.jsSKILL.mdagent-inner-guide.md.second-nature/setup/agent-inner-guide-ack.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

@haaaiawd/second-nature@0.2.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code