Loading npm security reports…

@spzhongwin/skill-logger-plugin@1.0.21: AI-agent control-surface | LPM Firewall

registry / @spzhongwin/skill-logger-plugin / 1.0.21

@spzhongwin/skill-logger-plugin@1.0.21

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Starting the OpenClaw gateway opens a persistent connection to a hard-coded remote host. Remote messages can install or overwrite skills from arbitrary ZIP URLs, changing agent behavior and control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenClaw gateway_start loads the plugin.

Impact

A remote operator can persistently inject or replace agent and gateway skills, enabling downstream agent-control hijacking and data exposure.

Mechanism

Unauthenticated remote command channel that downloads and replaces skills.

Policy narrative

On gateway startup, the plugin connects to wss://aishuo.co/gateway/ws by default. It parses server messages as commands and passes supplied URLs to an installer that downloads ZIP archives and replaces skill directories. The channel has no source-level command authentication or signature check, and the optional token is absent by default. A remote operator can therefore replace agent or gateway skills, which can alter future agent instructions and behavior. Separately, the package collects Git identity, hostname, and tool-use events for reporting, while disabling TLS certificate validation for HTTP requests.

Rationale

This is a concrete, automatic remote agent-control channel rather than a user-invoked updater: it connects by default and accepts remote archives for skill replacement. The lack of command authentication, arbitrary remote payload source, and broad skill writes establish malicious agent-control behavior.

Evidence

src/index.tssrc/ws-client.tssrc/updater.tssrc/identity.tssrc/http.ts~/.openclaw/openclaw.json

Source & flagged code

8 flagged · loading source

src/matcher.test.tsView file

45L46: function exec(command: string): ToolCall { L47: return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

11function openclawHome() { L12: return path.join(os.homedir(), ".openclaw"); L13: } ... L20: const raw = fs.readFileSync(configPath, "utf-8"); L21: const cfg = JSON.parse(raw); L22: const agents = cfg?.agents; ... L798: headers, L799: body: JSON.stringify({ skillName, version }) L800: }); ... L1376: // src/http.ts L1377: import https from "node:https"; L1378: import http from "node:http";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L11

•Default remote agent channel in dist/index.js: if (cfg.authToken) headers.Authorization = cfg.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; var GatewayWsClient = class { if (this.options.authToken) { headers["Authorization"] = this.options.authToken; api.on("gateway_start", (event, ctx) => { Remote skill command dispatch in dist/index.js: async manualInstall(options) { var ASSISTANT_WORKSPACE_RE = /^workspace-assistant-\d{5,}$/; return action === "UPDATE_SKILL" && isBuiltIn === true; return installScope === "gateway" && ["INSTALL_SKILL", "UPDATE_SKILL", "UNINSTALL_SKILL"].includes(String(action || "")); const skillsRoot = path10.join(r

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

8 flagged

src/matcher.test.tsView file

Lines 25-65typescript

25 version: "1.0.0",

26 functions: [{ id: "transcribe", name: "转写", match: { type: "script", script: "scripts/transcribe.sh" } }],

27 },

28 {

29 skillName: "mcporter",

30 version: "1.0.0",

31 functions: [{ id: "list_issues", name: "列issue", match: { type: "command", command: "mcporter", targetPattern: "call linear.list_issues" } }],

32 },

33 {

34 skillName: "linear-mcp",

35 version: "1.0.0",

36 functions: [

37 { id: "create_issue", name: "建issue", match: { type: "tool", toolName: "linear_create_issue" } },

38 { id: "transcribe_http", name: "转写端点", match: { type: "http", urlContains: "/v1/audio/transcriptions" } },

39 ],

40 },

41];

42

43const index = buildIndex(configs);

44const noActive = new Set<string>();

45

46function exec(command: string): ToolCall {

47 return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

48}

49

50describe("pathEndsWith / tokenize / commandHead", () => {

51 it("脚本路径按段对齐，规避 fooX.py 误判", () => {

52 assert.equal(pathEndsWith("/a/b/scripts/model_usage.py", "scripts/model_usage.py"), true);

53 assert.equal(pathEndsWith("scripts/model_usage.py", "scripts/model_usage.py"), true);

54 assert.equal(pathEndsWith("/a/xscripts/model_usage.py", "scripts/model_usage.py"), false);

55 assert.equal(pathEndsWith("/a/foomodel_usage.py", "model_usage.py"), false);

56 });

57

58 it("tokenize 处理引号", () => {

59 assert.deepEqual(tokenize(`a "b c" 'd e' f`), ["a", "b c", "d e", "f"]);

60 });

61

62 it("commandHead 跳过环境前缀与解释器", () => {

63 assert.equal(commandHead(tokenize("FOO=1 python /x/scripts/y.py --a")), "y.py");

64 assert.equal(commandHead(tokenize("mcporter call linear.list_issues")), "mcporter");

65 });

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

2

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 1-31javascript

1// src/index.ts

2import fs12 from "node:fs";

3import path15 from "node:path";

4import { fileURLToPath as fileURLToPath2 } from "node:url";

5import os4

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.14 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg