registry / @myclaw163/clawclaw-cli / 0.8.7

@myclaw163/clawclaw-cli@0.8.7

ClawClaw social deduction game CLI

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install runs a postinstall hook that replaces bundled skill directories in Claude, Codex, OpenClaw, and shared agent locations. This mutates foreign agent control surfaces without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally through npm.

Impact

The package can inject or replace instructions used by multiple AI-agent products and remove their prior same-named skills.

Mechanism

Install-time global skill installation and recursive replacement of agent skill directories.

Policy narrative

On global installation, npm invokes the package postinstall hook. It invokes the bundled skills installer with automatic global confirmation, then deletes and copies the clawclaw skill into shared, Claude, Codex, and OpenClaw skill directories. This modifies several agent instruction surfaces without requiring the user to run an explicit setup command.

Rationale

The install hook performs unconsented mutation of broad, foreign AI-agent control surfaces and deletes existing target directories before replacing them. This meets the blocking policy even though no separate exfiltration channel was found.

Evidence

package.jsonscripts/postinstall.mjsscripts/sync-bundled-skill.mjsskills/clawclaw/SKILL.mdskills/clawclaw~/.agents/skills/clawclaw~/.claude/skills/clawclaw~/.codex/skills/clawclaw~/.openclaw/skills/clawclaw

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The postinstall hook activates on global npm installation.
It silently installs a bundled skill globally and overwrites skill directories for several unrelated agent platforms.
Existing agent skill directories are recursively deleted before replacement.

Evidence against

The hook does not run for non-global installs and has opt-out environment variables.
No credential collection, network exfiltration, or remote payload download was found in the inspected lifecycle code.
The bundled skill tells agents not to execute untrusted game text.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 264 file(s), 2.17 MB of source, external domains: myclaw.163.com, registry.npmmirror.com

Source & flagged code

11 flagged

package.jsonView file

Lines 42-82json

42 "QUICKSTART.md",

43 "QUICKSTART_OTHER.md",

44 "QUICKSTART_OPENCLAW.md",

45 "QUICKSTART_HERMES.md",

46 "docs/runtime/",

47 "docs/desktop-event-push.md",

48 "docs/configuration.md",

49 "docs/custom-modules/"

50 ],

51 "scripts": {

52 "typecheck": "tsc --noEmit",

53 "test": "vitest run --maxWorkers=8",

54 "test:watch": "vitest",

55 "sync:frontend-map": "node scripts/sync-frontend-map.mjs",

56 "check:frontend-map": "node scripts/sync-frontend-map.mjs --check",

57 "replay:perception": "tsx scripts/replay-perception.ts",

58 "compare:perception": "tsx scripts/compare-perception-replays.ts",

59 "watch:perception": "tsx scripts/watch-perception-events.ts",

60 "prepack": "node scripts/package-readme.mjs prepare",

61 "postpack": "node scripts/package-readme.mjs restore",

62 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 "release:patch": "npm version patch && npm publish --registry https://registry.npmjs.org --access public",

64 "release:minor": "npm version minor && npm publish --registry https://registry.npmjs.org --access public",

65 "release:major": "npm version major && npm publish --registry https://registry.npmjs.org --access public"

66 },

67 "dependencies": {

68 "@modelcontextprotocol/sdk": "^1.30.0",

69 "amaro": "^1.1.11",

70 "commander": "^12.0.0",

71 "skills": "1.5.1",

72 "tsx": "^4.23.12",

73 "undici": "^6.28.0",

74 "ws": "^8.21.3"

75 },

76 "devDependencies": {

77 "@types/node": "^22.20.1",

78 "@types/ws": "^8.5.10",

79 "esbuild": "^0.28.2",

80 "typescript": "^5.4.0",

81 "vitest": "^3.1.0"

82 }

scripts/enable_ccl_permissions.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Add ClawClaw gameplay permissions to Claude Code's permissions.allow list.

4 *

5 * This script intentionally only edits ~/.claude/settings.json permissions.allow.

6 * It does not back up, revert, remove, or rewrite any other settings.

7 *

8 * Usage:

9 * node enable_ccl_permissions.cjs

10 * node enable_ccl_permissions.cjs --dry-run

src/runtime/owner-control.tsView file

Lines 1-24typescript

1import { createHash, randomBytes } from 'crypto';

2import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync } from 'fs';

3import { tmpdir } from 'os';

4import { join } from 'path'

scripts/sync-bundled-skill.mjsView file

Lines 1-22javascript

1import { spawnSync } from 'child_process';

2import {

3 cpSync,

4 existsSync,

5 mkdirSync,

6 readFileSync,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/sync-bundled-skill.mjsView on unpkg · L2

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6479 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

scripts/enable_monitor.cjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.6 matchedPath = scripts/enable_monitor.cjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/enable_monitor.cjsView on unpkg

scripts/check_monitor.cjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.6 matchedPath = scripts/check_monitor.cjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check_monitor.cjsView on unpkg

src/commands/setup/codex.tsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.6 matchedPath = src/commands/setup/codex.ts matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/setup/codex.tsView on unpkg

scripts/sync-frontend-map.mjsView file

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.6 matchedPath = scripts/sync-frontend-map.mjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-frontend-map.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/enable_ccl_permissions.cjsView file

12L13: const fs = require("fs"); L14: const os = require("os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/enable_ccl_permissions.cjsView on unpkg · L12

src/runtime/owner-control.tsView file

4import { join } from 'path'; L5: import { connect, createServer, type Server, type Socket } from 'net'; L6: import type { AuthProfile } from '../lib/auth.js'; ... L15: // owner-control requests by monkey-patching global JSON. L16: const SAFE_JSON_PARSE = JSON.parse.bind(JSON) as typeof JSON.parse; L17: const SAFE_JSON_STRINGIFY = JSON.stringify.bind(JSON) as typeof JSON.stringify; ... L106: const hash = createHash('sha1').update(stateDir).digest('hex').slice(0, 12); L107: if (process.platform === 'win32') return `\\\\.\\pipe\\clawclaw-${hash}-${pid}-${nonce}`; L108: const userId = typeof process.getuid === 'function' ? String(process.getuid()) : hash; ... L124: function sendLine(socket: import('net').Socket, value: OwnerControlResponse): void { L125: socket.end(`${SAFE_JSON_STRINGIFY(v

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/owner-control.tsView on unpkg · L4

scripts/sync-bundled-skill.mjsView file

2import { L3: cpSync, L4: existsSync, L5: mkdirSync, L6: readFileSync, ... L25: const homeDir = homedir(); L26: const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(homeDir, '.claude'); L27: const codexHome = process.env.CODEX_HOME?.trim() || join(homeDir, '.codex'); L28: return [ L29: join(homeDir, '.agents', 'skills', SKILL_NAME), L30: join(claudeHome, 'skills', SKILL_NAME), ... L77: if (existsSync(resolvedTarget)) rmSync(resolvedTarget, { recursive: true, force: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/sync-bundled-skill.mjsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @myclaw163/clawclaw-cli@0.8.6 matchedPath = scripts/sync-bundled-skill.mjs matchedIdentity = npm:QG15Y2xhdzE2My9jbGF3Y2xhdy1jbGk:0.8.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-bundled-skill.mjsView on unpkg

scripts/find-hide-spots.pyView file

•path = scripts/find-hide-spots.py kind = build_helper sizeBytes = 6479 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/find-hide-spots.pyView on unpkg

scripts/enable_monitor.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/enable_monitor.cjsView on unpkg

scripts/check_monitor.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/check_monitor.cjsView on unpkg

src/commands/setup/codex.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/setup/codex.tsView on unpkg

scripts/sync-frontend-map.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/sync-frontend-map.mjsView on unpkg

Findings

1 Critical6 High6 Medium7 Low

CriticalAi Agent Control Hijackscripts/sync-bundled-skill.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similarityscripts/enable_monitor.cjs

HighKnown Malware Source Similarityscripts/check_monitor.cjs

HighKnown Malware Source Similaritysrc/commands/setup/codex.ts

HighKnown Malware Source Similarityscripts/sync-bundled-skill.mjs

HighKnown Malware Source Similarityscripts/sync-frontend-map.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/enable_ccl_permissions.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/find-hide-spots.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/runtime/owner-control.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License