registry / AI-agent control-surface risk / @harness-memory/openclaw

@harness-memory/openclaw

OpenClaw native memory plugin backed by harness-memory (SQLite + FTS5, atom/tree/raw recall).

This report shows the evidence for @harness-memory/openclaw@0.2.1. 1 of 3 known versions is blocked or flagged. The newest version, 0.2.2, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, unconsented install-time mutation of a foreign AI-agent control surface, even though the behavior is documented and conditional. No network exfiltration or concealed payload was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package when harnessmemory-bridge and harness-memory are available.

Impact

Unconsented replacement of the active OpenClaw memory extension during dependency installation.

Mechanism

postinstall invokes external setup that writes OpenClaw plugin configuration

Policy narrative

On npm install, the postinstall probes for companion executables and, if present, runs `harness-memory openclaw setup`. The packaged setup implementation writes `~/.openclaw/openclaw.json` and assigns `plugins.slots.memory` to this plugin, potentially displacing another configured memory extension without an explicit setup command.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/setup.jsREADME.md~/.openclaw/openclaw.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 92.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.mjs on npm install.
scripts/postinstall.mjs probes executables then invokes `harness-memory openclaw setup`.
The postinstall comments and output state setup writes OpenClaw's openclaw.json.
dist/setup.js sets plugins.slots.memory to harnessmemory, replacing an existing memory slot.

Evidence against

Postinstall is conditional on an installed bridge and CLI, and can be disabled with HARNESSMEMORY_SKIP_POSTINSTALL=1.
The configuration behavior is openly documented in README.md; no hidden network client or payload loader was found.
Runtime bridge communication is local child-process stdin/stdout JSON-RPC.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 74.0 KB of source, external domains: astral.sh

Source & flagged code

2 flagged

package.jsonView file

Lines 1-34json

2 "name": "@harness-memory/openclaw",

3 "version": "0.2.1",

4 "description": "OpenClaw native memory plugin backed by harness-memory (SQLite + FTS5, atom/tree/raw recall).",

5 "license": "MIT",

6 "type": "module",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "scripts": {

10 "build": "tsc -p .",

11 "prepack": "npm run build",

12 "typecheck": "tsc --noEmit -p .",

13 "test": "tsx --test src/*.test.ts",

14 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "openclaw": {

17 "extensions": [

18 "./dist/index.js"

19 ],

20 "runtimeExtensions": [

21 "./dist/index.js"

22 ],

23 "install": {

24 "minHostVersion": ">=2026.4.11"

25 },

26 "compat": {

27 "pluginApi": ">=2026.4.11"

28 }

29 },

30 "publishConfig": {

31 "access": "public"

32 },

33 "dependencies": {},

34 "devDependencies": {

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @harness-memory/openclaw@0.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @harness-memory/openclaw@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-20 18:39:05.016Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.2.2latestClean—AllowPublishedJul 9, 2026, 8:37 AM 0.2.1shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 3, 2026, 3:44 AM 0.2.0Clean—AllowPublishedJul 2, 2026, 8:43 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code