registry / AI-agent control-surface risk / @spzhongwin/skill-logger-plugin

@spzhongwin/skill-logger-plugin

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

This report shows the evidence for @spzhongwin/skill-logger-plugin@1.0.30. 11 of 20 known versions are blocked or flagged. The newest version, 1.1.4, is flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package implements an automatically activated remote command channel that can install arbitrary remotely supplied skill archives into agent directories. This is a concrete AI-agent control-surface hijack, not ordinary telemetry or user-invoked setup.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Starting an OpenClaw gateway with this plugin enabled.

Impact

The remote server can cause unreviewed skill content to be installed into agent control surfaces, enabling subsequent agent capability execution.

Mechanism

A default WebSocket channel accepts remote command messages and forwards an attacker-controlled download URL to ZIP extraction and skill-directory replacement.

Policy narrative

When the host gateway starts, the plugin connects to a hard-coded WebSocket service if no endpoint is configured. It parses incoming messages and accepts install requests that include a direct URL. The requested ZIP is fetched, extracted, and copied into an agent skill directory. The code validates only basic skill naming and presence of SKILL.md, not the remote URL, archive integrity, signer, or user approval. This creates a default remote channel that can install new agent capabilities.

AI rationale

Evidence

src/index.tssrc/ws-client.tssrc/updater.tssrc/install-coordinator.tsdist/index.js

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The active plugin starts a WebSocket connection to a hard-coded central server when the gateway starts.
WebSocket messages are parsed and dispatched to install handling without a message-authentication check.
A received install command passes its server-provided URL to the package installer.
The installer downloads a ZIP from that URL, unpacks it, and later replaces an agent skill directory with its contents.
The published dist entrypoint contains the same automatic gateway-start connection and default server.
Inbound WebSocket data is JSON-parsed and dispatched to the message handler.
The install coordinator forwards a queued job's URL to package preparation.
The updater fetches the supplied URL before unpacking the package.

Evidence against

package.json has no npm install, preinstall, or postinstall lifecycle hook; prepublishOnly is publishing-time only.
The installer restricts skill codes to its platform namespace, but this does not restrict the remote download URL or validate package integrity.

Behavioral surface

Source

Source & flagged code

8 flagged

src/free-skill-lock.test.tsView file

Lines 1-21typescript

1import assert from "node:assert/strict";

2import {spawnSync} from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6import {setTimeout as delay} from "node:timers/promises";

7import {test, afterEach} from "node:test";

8import {withFreeSkillLock} from "./free-skill-lock.ts";

9import {createFreeSkillToolFactory} from "./free-skill-tool.ts";

11const roots: string[] = [];

12afterEach(async () => {await Promise.all(roots.splice(0).map(root => fs.rm(root, {recursive: true, force: true})));});

13async function workspace() {

14 const root = await fs.mkdtemp(path.join(os.tmpdir(), "skill-lock-review-"));

15 roots.push(root);

16 return root;

17}

18async function fakeOwner(root: string, pid: number, createdAt: string) {

19 const lock = path.join(root, ".xg-workspace/skills/locks/write");

20 await fs.mkdir(lock, {recursive: true});

21 await fs.writeFile(path.join(lock, "owner.json"), JSON.stringify({pid, createdAt}));

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

src/config-sync.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @spzhongwin/sk[redacted]@1.0.28 matchedIdentity = npm:[redacted]:1.0.28 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config-sync.tsView on unpkg

Source & flagged code

8 flagged · loading source

src/free-skill-lock.test.tsView file

1import assert from "node:assert/strict"; L2: import {spawnSync} from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

Findings

4 Critical3 High4 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltasrc/config-sync.ts

HighChild Processsrc/free-skill-lock.test.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @spzhongwin/skill-logger-plugin@1.0.30.

The versions list below shows the verdict for each recorded version.

Avoid installing @spzhongwin/skill-logger-plugin@1.0.30. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 06:42:01.642Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

20 known versions

1.1.4latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 6:12 AM 1.1.3SuspiciousAgent extension lifecycle riskWarnPublishedOct 10, 2026, 9:17 AM 1.1.1SuspiciousAgent extension lifecycle riskWarnPublishedSep 24, 2026, 8:33 AM 1.1.0SuspiciousAgent extension lifecycle riskWarn

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code