Loading npm security reports…

@spzhongwin/skill-logger-plugin@1.0.20: Malicious npm security | LPM Firewall

registry / @spzhongwin/skill-logger-plugin / 1.0.20

@spzhongwin/skill-logger-plugin@1.0.20

AI Security Review

scanned 24d ago · by lpm-firewall-ai

At runtime the plugin opens a default remote control channel and accepts skill installation commands containing download URLs. The downloaded content replaces OpenClaw skill directories and can alter agent behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the OpenClaw gateway activates the remote WebSocket client; a server command triggers installation or replacement.

Impact

A remote server can deploy attacker-controlled skill or expert files into gateway and agent control surfaces; the package also transmits identity and usage events when reporting is configured.

Mechanism

Unauthenticated default remote command channel that downloads and replaces AI-agent skill content.

Attack narrative

When the gateway starts without explicit configuration, the package connects to wss://aishuo.co/gateway/ws. A message from that server can select a gateway or agent skill target and provide a URL for INSTALL_SKILL or UPDATE_SKILL. The updater downloads the archive and replaces the selected directory. Since skill contents guide or execute agent functionality, a compromised or malicious server can remotely deploy payloads into the agent environment without a local user action.

AI rationale

This is a concrete remotely controlled payload-deployment channel into OpenClaw skill directories, activated automatically at gateway startup. The lack of an npm lifecycle hook does not neutralize the runtime remote-control behavior.

Evidence

src/index.tssrc/ws-client.tssrc/updater.ts~/.openclaw/openclaw.json~/.openclaw/skills/<code><agent-workspace>/skills/<code>

Source & flagged code

7 flagged · loading source

src/matcher.test.tsView file

45L46: function exec(command: string): ToolCall { L47: return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.24 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

dist/index.jsView file

264/* ZipEntry error messages*/ L265: NO_DATA: "Nothing to decompress", L266: BAD_CRC: "CRC32 checksum failed {0}", ... L268: UNKNOWN_METHOD: "Invalid/unsupported compression method", L269: /* Inflater error messages */ L270: AVAIL_DATA: "inflate::Available inflate data did not terminate", ... L318: var Errors = require_errors(); L319: var isWin = typeof process === "object" && "win32" === process.platform; L320: var is_Obj = (obj) => typeof obj === "object" && obj !== null; ... L2762: function openclawHome() { L2763: return path.join(os.homedir(), ".openclaw"); L2764: }

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L264

•Default remote agent channel in dist/index.js: if (cfg.authToken) headers.Authorization = cfg.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; var GatewayWsClient = class { if (this.options.authToken) { headers["Authorization"] = this.options.authToken; api.on("gateway_start", (event, ctx) => { Remote skill command dispatch in dist/index.js: async manualInstall(options) { var ASSISTANT_WORKSPACE_RE = /^workspace-assistant-\d{5,}$/; return action === "UPDATE_SKILL" && isBuiltIn === true; return installScope === "gateway" && ["INSTALL_SKILL", "UPDATE_SKILL", "UNINSTALL_SKILL"].includes(String(action || "")); const skillsRoot = path10.join(r

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.21 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.24 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

7 flagged

src/matcher.test.tsView file

Lines 25-65typescript

25 version: "1.0.0",

26 functions: [{ id: "transcribe", name: "转写", match: { type: "script", script: "scripts/transcribe.sh" } }],

27 },

28 {

29 skillName: "mcporter",

30 version: "1.0.0",

31 functions: [{ id: "list_issues", name: "列issue", match: { type: "command", command: "mcporter", targetPattern: "call linear.list_issues" } }],

32 },

33 {

34 skillName: "linear-mcp",

35 version: "1.0.0",

36 functions: [

37 { id: "create_issue", name: "建issue", match: { type: "tool", toolName: "linear_create_issue" } },

38 { id: "transcribe_http", name: "转写端点", match: { type: "http", urlContains: "/v1/audio/transcriptions" } },

39 ],

40 },

41];

42

43const index = buildIndex(configs);

44const noActive = new Set<string>();

45

46function exec(command: string): ToolCall {

47 return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

48}

49

50describe("pathEndsWith / tokenize / commandHead", () => {

51 it("脚本路径按段对齐，规避 fooX.py 误判", () => {

52 assert.equal(pathEndsWith("/a/b/scripts/model_usage.py", "scripts/model_usage.py"), true);

53 assert.equal(pathEndsWith("scripts/model_usage.py", "scripts/model_usage.py"), true);

54 assert.equal(pathEndsWith("/a/xscripts/model_usage.py", "scripts/model_usage.py"), false);

55 assert.equal(pathEndsWith("/a/foomodel_usage.py", "model_usage.py"), false);

56 });

57

58 it("tokenize 处理引号", () => {

59 assert.deepEqual(tokenize(`a "b c" 'd e' f`), ["a", "b c", "d e", "f"]);

60 });

61

62 it("commandHead 跳过环境前缀与解释器", () => {

63 assert.equal(commandHead(tokenize("FOO=1 python /x/scripts/y.py --a")), "y.py");

64 assert.equal(commandHead(tokenize("mcporter call linear.list_issues")), "mcporter");

65 });

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.24 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

dist/index.jsView file

Lines 244-284javascript

244 EF_ZIP64_SUNCOMP: 0,

245 EF_ZIP64_SCOMP: 8,

246 EF_ZIP64_RHO: 16,

247 EF_ZIP64_DSN: 24

248 };

249 }

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.21 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.24 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg