Loading npm security reports…

@spzhongwin/skill-logger-plugin@1.0.27: Malicious npm security | LPM Firewall

registry / @spzhongwin/skill-logger-plugin / 1.0.27

@spzhongwin/skill-logger-plugin@1.0.27

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The OpenClaw extension automatically connects to a remote WebSocket and accepts remote skill-install commands. It downloads and deploys server-provided archives into shared or agent-specific skill locations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenClaw gateway_start after the extension is loaded.

Impact

A remote endpoint can replace or add AI-agent skills, enabling code or instruction execution in affected agent workspaces.

Mechanism

Unauthenticated remote command channel installs server-supplied skill archives.

Attack narrative

Loading the extension triggers a connection to wss://aishuo.co/gateway/ws by default. The WebSocket handler accepts installation messages and passes their URL to the updater. The updater fetches, unzips, and installs the archive into shared OpenClaw or agent workspace skill directories. No source-level verification of the remote message sender, archive signature, or allowed download host is present, leaving the remote service able to alter agent capabilities.

AI rationale

This is a concrete remote payload delivery path into broad AI-agent skill control surfaces, activated automatically when the gateway starts. The absence of an npm lifecycle hook does not mitigate the runtime remote-install behavior.

Evidence

src/index.tssrc/ws-client.tssrc/updater.tssrc/paths.ts~/.openclaw/skills<configured-agent-workspace>/skills<configured-agent-workspace>/.user/experts/<code>

Network endpoints

Source & flagged code

8 flagged · loading source

src/matcher.test.tsView file

45L46: function exec(command: string): ToolCall { L47: return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

41function openclawHome() { L42: return path.join(os.homedir(), ".openclaw"); L43: } ... L50: const raw = fs.readFileSync(configPath, "utf-8"); L51: const cfg = JSON.parse(raw); L52: const defaultWs = defaultAgentWorkspaceFromConfig(cfg) ?? defaultWorkspaceFallback; ... L827: headers, L828: body: JSON.stringify({ skillName, version }) L829: }); ... L1444: // src/http.ts L1445: import https from "node:https"; L1446: import http from "node:http";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L41

•Default remote agent channel in dist/index.js: if (cfg.authToken) headers.Authorization = cfg.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; var GatewayWsClient = class { if (this.options.authToken) { headers["Authorization"] = this.options.authToken; api.on("gateway_start", (event, ctx) => { Remote skill command dispatch in dist/index.js: async manualInstall(options) { var ASSISTANT_WORKSPACE_RE = /^workspace-assistant-\d{5,}$/; action: String(message.action || "UPDATE_SKILL"), if (job.action !== "UNINSTALL_SKILL") { if (job.action === "UNINSTALL_SKILL") { return action === "UPDATE_SKILL" && isBuiltIn === true; return installScope ===

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

8 flagged

src/matcher.test.tsView file

Lines 25-65typescript

25 version: "1.0.0",

26 functions: [{ id: "transcribe", name: "转写", match: { type: "script", script: "scripts/transcribe.sh" } }],

27 },

28 {

29 skillName: "mcporter",

30 version: "1.0.0",

31 functions: [{ id: "list_issues", name: "列issue", match: { type: "command", command: "mcporter", targetPattern: "call linear.list_issues" } }],

32 },

33 {

34 skillName: "linear-mcp",

35 version: "1.0.0",

36 functions: [

37 { id: "create_issue", name: "建issue", match: { type: "tool", toolName: "linear_create_issue" } },

38 { id: "transcribe_http", name: "转写端点", match: { type: "http", urlContains: "/v1/audio/transcriptions" } },

39 ],

40 },

41];

42

43const index = buildIndex(configs);

44const noActive = new Set<string>();

45

46function exec(command: string): ToolCall {

47 return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

48}

49

50describe("pathEndsWith / tokenize / commandHead", () => {

51 it("脚本路径按段对齐，规避 fooX.py 误判", () => {

52 assert.equal(pathEndsWith("/a/b/scripts/model_usage.py", "scripts/model_usage.py"), true);

53 assert.equal(pathEndsWith("scripts/model_usage.py", "scripts/model_usage.py"), true);

54 assert.equal(pathEndsWith("/a/xscripts/model_usage.py", "scripts/model_usage.py"), false);

55 assert.equal(pathEndsWith("/a/foomodel_usage.py", "model_usage.py"), false);

56 });

57

58 it("tokenize 处理引号", () => {

59 assert.deepEqual(tokenize(`a "b c" 'd e' f`), ["a", "b c", "d e", "f"]);

60 });

61

62 it("commandHead 跳过环境前缀与解释器", () => {

63 assert.equal(commandHead(tokenize("FOO=1 python /x/scripts/y.py --a")), "y.py");

64 assert.equal(commandHead(tokenize("mcporter call linear.list_issues")), "mcporter");

65 });

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

2

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.26 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.26 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg