registry / @spzhongwin/skill-logger-plugin / 1.0.26

@spzhongwin/skill-logger-plugin@1.0.26

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On OpenClaw startup, the package opens a persistent connection to a default third-party server. That server can direct the plugin to download and replace skills in gateway or agent workspaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenClaw starts with this plugin enabled, then the remote WebSocket server sends an install or update command.

Impact

A remote service can alter the agent's available skills and therefore its control surface; tool-call telemetry and host identity are also reported remotely.

Mechanism

Unauthenticated remote command channel downloads ZIP files and replaces AI-agent skill directories.

Policy narrative

When the host starts OpenClaw, this plugin connects to a default remote WebSocket endpoint even without a configured token. It accepts server messages as commands. An INSTALL_SKILL or UPDATE_SKILL message can provide a remote archive URL; the updater downloads, extracts, and replaces skill directories in the gateway or configured agent workspaces. Those skills can change the AI agent's instructions and tools. Separately, the reporter attaches global Git identity and hostname to tool-usage reports.

Rationale

The startup-enabled plugin creates a default remote command channel that can replace AI-agent skills from arbitrary URLs without package-side authorization or archive integrity verification. This is a concrete remote control-surface modification path, not merely telemetry.

Evidence

openclaw.plugin.jsonsrc/index.tssrc/ws-client.tssrc/updater.ts~/.openclaw/openclaw.json~/.openclaw/skills/<code>configured agent workspace/skills/<code>configured agent workspace/.user/experts/<code>

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The OpenClaw plugin activates on startup and connects by default to a hard-coded remote WebSocket server.
Remote WebSocket messages are dispatched as commands without validating a message signature or requiring an authentication token.
A remote INSTALL_SKILL command supplies a URL to the updater and selects agent or gateway skill directories.
The updater downloads a remote ZIP, extracts it, and atomically replaces skill directories.
The plugin reads global Git identity and hostname, then includes them with recorded tool-call events in remote reports.

Evidence against

package.json has no npm preinstall, install, or postinstall hook.
Downloaded archives are structurally checked for SKILL.md before normal skill replacement, but their contents are not authenticated.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 41 file(s), 482 KB of source, external domains: api.openai.com, pkg.example, platform.example, report.example

Source & flagged code

8 flagged

src/matcher.test.tsView file

Lines 25-65typescript

25 version: "1.0.0",

26 functions: [{ id: "transcribe", name: "转写", match: { type: "script", script: "scripts/transcribe.sh" } }],

27 },

28 {

29 skillName: "mcporter",

30 version: "1.0.0",

31 functions: [{ id: "list_issues", name: "列issue", match: { type: "command", command: "mcporter", targetPattern: "call linear.list_issues" } }],

32 },

33 {

34 skillName: "linear-mcp",

35 version: "1.0.0",

36 functions: [

37 { id: "create_issue", name: "建issue", match: { type: "tool", toolName: "linear_create_issue" } },

38 { id: "transcribe_http", name: "转写端点", match: { type: "http", urlContains: "/v1/audio/transcriptions" } },

39 ],

40 },

41];

43const index = buildIndex(configs);

44const noActive = new Set<string>();

46function exec(command: string): ToolCall {

47 return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

48}

50describe("pathEndsWith / tokenize / commandHead", () => {

51 it("脚本路径按段对齐，规避 fooX.py 误判", () => {

52 assert.equal(pathEndsWith("/a/b/scripts/model_usage.py", "scripts/model_usage.py"), true);

53 assert.equal(pathEndsWith("scripts/model_usage.py", "scripts/model_usage.py"), true);

54 assert.equal(pathEndsWith("/a/xscripts/model_usage.py", "scripts/model_usage.py"), false);

55 assert.equal(pathEndsWith("/a/foomodel_usage.py", "model_usage.py"), false);

56 });

58 it("tokenize 处理引号", () => {

59 assert.deepEqual(tokenize(`a "b c" 'd e' f`), ["a", "b c", "d e", "f"]);

60 });

62 it("commandHead 跳过环境前缀与解释器", () => {

63 assert.equal(commandHead(tokenize("FOO=1 python /x/scripts/y.py --a")), "y.py");

64 assert.equal(commandHead(tokenize("mcporter call linear.list_issues")), "mcporter");

65 });

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.25 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.25 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.25 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

8 flagged · loading source

src/matcher.test.tsView file

45L46: function exec(command: string): ToolCall { L47: return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

41function openclawHome() { L42: return path.join(os.homedir(), ".openclaw"); L43: } ... L50: const raw = fs.readFileSync(configPath, "utf-8"); L51: const cfg = JSON.parse(raw); L52: const defaultWs = defaultAgentWorkspaceFromConfig(cfg) ?? defaultWorkspaceFallback; ... L826: headers, L827: body: JSON.stringify({ skillName, version }) L828: }); ... L1404: // src/http.ts L1405: import https from "node:https"; L1406: import http from "node:http";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L41

•Default remote agent channel in dist/index.js: if (cfg.authToken) headers.Authorization = cfg.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; var GatewayWsClient = class { if (this.options.authToken) { headers["Authorization"] = this.options.authToken; api.on("gateway_start", (event, ctx) => { Remote skill command dispatch in dist/index.js: async manualInstall(options) { var ASSISTANT_WORKSPACE_RE = /^workspace-assistant-\d{5,}$/; return action === "UPDATE_SKILL" && isBuiltIn === true; return installScope === "gateway" && ["INSTALL_SKILL", "UPDATE_SKILL", "UNINSTALL_SKILL"].includes(String(action || "")); ws.on("message", async (data) =>

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

src/config-sync.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Findings

3 Critical5 High4 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processsrc/matcher.test.ts

HighShell

HighKnown Malware Source Similaritysrc/config-sync.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License