registry / @okki-global/okki-claw / 1.2.4-beta

@okki-global/okki-claw@1.2.4-beta

Node.js sidecar that bridges local OpenClaw gateway to the agent-relay cloud relay.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a sidecar/CLI that intentionally bridges local agent/OpenClaw services to an agent-relay endpoint and manages configured ACP agent processes.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs okki-claw CLI/API commands such as pair, run, daemon, update, or agent-relay-mcp.

Impact

Runtime network and process control within the documented sidecar purpose; no install-time mutation, stealth persistence, or unrelated exfiltration found.

Mechanism

Package-aligned sidecar relay, pairing config writes, optional self-update, and agent process management.

Rationale

Static inspection found powerful network, process, and config-write primitives, but they are documented and activated by user/runtime sidecar commands rather than npm install/import-time abuse. No concrete credential exfiltration, destructive behavior, remote payload execution, or unconsented AI-agent control-surface mutation was found.

Evidence

package.jsonREADME.mddist/index.jsdist/main.jsdist/chunk-G2TVJH3L.js~/.agent-relay/config.json~/.agent-relay/sidecar.lock~/.agent-relay/sidecar.log~/.agent-relay/mcp.log~/.openclaw/openclaw.json~/.openclaw/identity/device.json~/.openclaw/identity/device-auth.json

Network endpoints4

agent-relay.okki.comlocalhost:8080localhost:18799wss://relay.agent-relay.io/tunnel

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/chunk-G2TVJH3L.js uses child_process for npm update, daemon spawn, ACP process listing/killing, and configured agent adapters.
dist/chunk-G2TVJH3L.js can save pairing/device config and custom ACP profiles under .agent-relay config at explicit runtime.
dist/main.js exposes MCP bridge tools that POST to configured bridge URLs with bearer auth.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
README.md describes a Node sidecar bridging local OpenClaw Gateway to agent-relay cloud relay, matching network/process behavior.
dist/main.js only runs CLI commands such as pair, run, daemon, update, and agent management; import entry dist/index.js just exports APIs.
Network defaults are package-aligned: agent-relay.okki.com, local OpenClaw/control UI, and user/env configured relay URLs.
Logs redact token/credential/secret fields; no credential harvesting or unrelated exfiltration flow found.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 270 KB of source, external domains: 127.0.0.1, agent-relay.okki.com

Source & flagged code

3 flagged

dist/chunk-G2TVJH3L.jsView file

Lines 1-21javascript

1import{execFile as Ro}from"child_process";import{readFile as Po}from"fs/promises";import{dirname as Io,join as Gn}from"path";import{fileURLToPath as Eo}from"url";import{promisify as To}from"util";var Oo=To(Ro),xo="@okki-global/okki-claw";async function Wt(){try{let t=Eo(import.meta.url),e=Gn(Io(t),".."),n=Gn(e,"package.json"),s=await Po(n,"utf-8");return JSON.parse(s).version}catch{return}}async function Uo(t={}){let e=t.packageName??xo,[n,s]=await Promise.all([Wt(),Do(e,t.npmCommand,t.commandRunner)]);return{packageName:e,currentVersion:n,latestVersion:s,updateAvailable:!!(n&&s&&No(s,n)>0)}}a ...

2Set OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN to override`)}let n;try{n=JSON.parse(e)}catch{throw new Error(`Invalid JSON in ${t.openclawConfigPath}`)}let s=n.gateway,r=s?.port??3e3,o=s?.auth?.token;console.log(`[discoverOpenClaw] parsed config file: gateway.port=${r} gateway.auth.token=${o?o.slice(0,8)+"...":"NOT_FOUND"}`);let i=t.openclawGatewayHost||"localhost",a=t.openclawGatewayPort??r,d=t.openclawGatewayToken||o;if(console.log(`[discoverOpenClaw] final resolution: host=${i} port=${a} token=${d?d.slice

3Set OPENCLAW_GATEWAY_TOKEN to override`);return{url:`http://${i}:${a}`,token:d}}async function ci(t){try{return(await fetch(`${t.url}/health`,{headers:{Authorization:`Bearer ${t.token}`},signal:AbortSignal.timeout(5e3)})).ok}catch{return!1}}function ms(t,e,n){let s=e.healthCheckIntervalSec*1e3;return setInterval(async()=>{await ci(t)||n()},s)}import di from"ws";var li="CONTROL_UI_ORIGIN_REJECTED",gs="CONTROL_UI_UPGRADE_FAILED",Ge=class{tunnelClient;socketFactory;controlUIConfig;sockets=new Map;constructor(e,n,s,r=(o,i)=>new di(o,i)){let o=s?.baseURL??"http://localhost:18799";this.controlUIConf ...

4`),{id:s,promise:r,cancel:i=>{let a=this.pendingRequests.get(s);a&&(this.pendingRequests.delete(s),a.reject(i))}}}sendNotification(e,n){if(!this.proc)throw new Error("ACP client not started");this.logRequest(e,n);let s={jsonrpc:"2.0",method:e,params:n};L("send_notification",{method:e,params:n,pendingRequests:this.pendingRequests.size}),this.proc.stdin.write(`${JSON.stringify(s)}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-G2TVJH3L.jsView on unpkg · L1

5`)}logRequest(e,n){if(e==="session/set_config_option"){console.info(`ACP request method=session/set_config_option session=${qs(String(n.sessionId??""))} config=${String(n.configId??"")}`);return}(e==="session/resume"||e==="session/prompt")&&console.info(`ACP request method=${e} session=${qs(String(n.sessionId??""))}`)}handleLine(e){let n=e.trim();if(!n)return;let s;try{s=JSON.parse(n)}catch{let r=R(n);L("stdout_fallback",{text:r}),this.options.onFallback?.({kind:"stdout",text:r});return}if(Aa(s),typeof s.method=="string"&&(typeof s.id=="number"||typeof s.id=="string")){this.handleProviderReque ...

6`)}rejectPendingRequests(e){if(this.pendingRequests.size===0)return;let n=new Error(R(e.message));L("reject_pending_requests",{message:n.message,count:this.pendingRequests.size});for(let s of this.pendingRequests.values())s.reject(n);this.pendingRequests.clear()}};function qs(t){let

7`);return r.exitCode===0?fe("available",void 0,Fa(o),$a(t)):xa.test(o)?fe("auth_needed","authenticate"):fe("error","configure")}catch(r){return Wa(r)?fe("not_installed","install"):fe("error","configure")}}function $a(t){return{resume:t==="claude"||t==="opencode"||t==="codex",streaming:!0,toolUse:!0,image:!1}}function fe(t,e,n,s={}){return{supported:!0,availability:t,setupCode:e,version:n,flags:s}}function Fa(t){let e=t.split(`

8`)[0]?.trim();if(e&&!/(token|apikey|api_key|secret|password|authorization|env|credential|path|home|user|stdout|stderr|commandOutput|\/Users\/|\/home\/)/i.test(e))return e.slice(0,120)}function qa(t,e){return new Promise((n,s)=>{let r=Pa(t,e,{env:Ie({...process.env}),stdio:["ignore","pipe","pipe"]}),o="",i="";r.stdout.setEncoding("utf8"),r.stderr.setEncoding("utf8"),r.stdout.on("data",a=>{o+=a}),r.stderr.on("data",a=>{i+=a}),r.on("error",s),r.on("close",a=>{n({exitCode:a??1,stdout:o,stderr:i})})})}function Wa(t){return typeof t=="object"&&t!==null&&"code"in t&&t.code==="ENOENT"}var ot=class{cap ...

9${new Error("stopSession caller").stack}`);let n=this.sessionStarts.get(e);if(n)try{await n}catch{}let s=this.sessions.get(e);if(this.sessionStarts.delete(e),!s){this.emitSessionState(e);return}try{await this.teardownSession(e,s)}finally{this.emitSessionState(e)}}getActiveSessionIds(){return Array.from(this.sessions.keys())}hasActiveSessions(){for(let e of this.sessions.values())if(!kc(e.runtimeStatus))return!0;return!1

10`).trim();if(!r)return null;if(r==="[DONE]")return{kind:"done"};let o=JSON.parse(r);return{kind:"event",eventType:o.type??n,payload:o}}function fr(t){return{model:t?.model,inputTokens:t?.usage?.input_tokens,outputTokens:t?.usage?.output_tokens}}function gn(t,e){let n=t?.response,s=n?.usage,r=

12\u26A0\uFE0F Device identity changed and must be re-approved.

14Copy and paste the following prompt into the OpenClaw chat to re-approve this device:

16\`\`\`

17${u}

18\`\`\``}this.emitTranscript({kind:"result",ts:y(),text:d,subtype:"error",isError:!0,errors:[d]}),this.emitStatus("error",d)}finally{this.activeAbortController===s&&(this.activeAbortController=null)}}async sendPromptViaHttp(e,n,s){let r=new Headers({Accept:"text/event-stream","Content-Type":"application/json",Authorization:`Bearer ${n.token}`

20\u8BF7\u5728 OpenClaw \u4E2D\u5B8C\u6210\u4EE5\u4E0B\u6B65\u9AA4\uFF1A

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/chunk-G2TVJH3L.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-G2TVJH3L.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-G2TVJH3L.jsView on unpkg · L1

1import{execFile as Ro}from"child_process";import{readFile as Po}from"fs/promises";import{dirname as Io,join as Gn}from"path";import{fileURLToPath as Eo}from"url";import{promisify a... L2: Set OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN to override`)}let n;try{n=JSON.parse(e)}catch{throw new Error(`Invalid JSON in ${t.openclawConfigPath}`)}let s=n.gateway,r=s?.po... L3: Set OPENCLAW_GATEWAY_TOKEN to override`);return{url:`http://${i}:${a}`,token:d}}async function ci(t){try{return(await fetch(`${t.url}/health`,{headers:{Authorization:`Bearer ${t.to... L4: `),{id:s,promise:r,cancel:i=>{let a=this.pendingRequests.get(s);a&&(this.pendingRequests.delete(s),a.reject(i))}}}sendNotification(e,n){if(!this.proc)throw new Error("ACP client no...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-G2TVJH3L.jsView on unpkg · L1

Findings

3 High2 Medium4 Low

HighChild Processdist/chunk-G2TVJH3L.js

HighSame File Env Network Executiondist/chunk-G2TVJH3L.js

HighCommand Output Exfiltrationdist/chunk-G2TVJH3L.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/chunk-G2TVJH3L.jsView file

Lines 1-21javascript

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-G2TVJH3L.jsView on unpkg · L1

12\u26A0\uFE0F Device identity changed and must be re-approved.

14Copy and paste the following prompt into the OpenClaw chat to re-approve this device:

16\`\`\`

17${u}

20\u8BF7\u5728 OpenClaw \u4E2D\u5B8C\u6210\u4EE5\u4E0B\u6B65\u9AA4\uFF1A

Long lines were clipped for display.