registry / @spzhongwin/skill-logger-plugin / 1.0.28

@spzhongwin/skill-logger-plugin@1.0.28

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a real remote agent-extension mutation capability with an unauthenticated-by-default control channel and unverified remote payloads. It is not an npm lifecycle attack, but the resulting agent control-surface risk remains unresolved and substantial.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenClaw loads the plugin and reaches gateway_start; the remote server then sends INSTALL_SKILL.

Impact

A controller of the configured or default server can place unverified skill content into agent control directories, enabling later agent-level code or instruction execution.

Mechanism

Default WebSocket command channel that downloads and replaces agent skills.

AI rationale

Evidence

openclaw.plugin.jsonsrc/index.tssrc/ws-client.tssrc/updater.tsopenclaw.jsonskills/<code>

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The plugin is configured to activate at OpenClaw startup.
Gateway startup defaults to a persistent connection to aishuo.co when no URL is configured.
The WebSocket accepts parsed server messages, while authorization is optional.
A remote INSTALL_SKILL message passes its URL directly to the installer.
The installer downloads, unzips, and replaces skill directories without signature verification.

Evidence against

package.json has no npm preinstall, install, or postinstall hook.
The remote installer restricts skill codes to one path segment and requires a SKILL.md root.
No eval, shell execution, or direct credential-file harvesting was found in the inspected control path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

8 flagged

src/matcher.test.tsView file

Lines 25-65typescript

25 version: "1.0.0",

26 functions: [{ id: "transcribe", name: "转写", match: { type: "script", script: "scripts/transcribe.sh" } }],

27 },

28 {

29 skillName: "mcporter",

30 version: "1.0.0",

31 functions: [{ id: "list_issues", name: "列issue", match: { type: "command", command: "mcporter", targetPattern: "call linear.list_issues" } }],

32 },

33 {

34 skillName: "linear-mcp",

35 version: "1.0.0",

36 functions: [

37 { id: "create_issue", name: "建issue", match: { type: "tool", toolName: "linear_create_issue" } },

38 { id: "transcribe_http", name: "转写端点", match: { type: "http", urlContains: "/v1/audio/transcriptions" } },

39 ],

40 },

41];

43const index = buildIndex(configs);

44const noActive = new Set<string>();

46function exec(command: string): ToolCall {

47 return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

48}

50describe("pathEndsWith / tokenize / commandHead", () => {

51 it("脚本路径按段对齐，规避 fooX.py 误判", () => {

52 assert.equal(pathEndsWith("/a/b/scripts/model_usage.py", "scripts/model_usage.py"), true);

53 assert.equal(pathEndsWith("scripts/model_usage.py", "scripts/model_usage.py"), true);

54 assert.equal(pathEndsWith("/a/xscripts/model_usage.py", "scripts/model_usage.py"), false);

55 assert.equal(pathEndsWith("/a/foomodel_usage.py", "model_usage.py"), false);

56 });

58 it("tokenize 处理引号", () => {

59 assert.deepEqual(tokenize(`a "b c" 'd e' f`), ["a", "b c", "d e", "f"]);

60 });

62 it("commandHead 跳过环境前缀与解释器", () => {

63 assert.equal(commandHead(tokenize("FOO=1 python /x/scripts/y.py --a")), "y.py");

64 assert.equal(commandHead(tokenize("mcporter call linear.list_issues")), "mcporter");

65 });

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/ws-client.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.27 matchedPath = src/ws-client.test.ts matchedIdentity = npm:[redacted]:1.0.27 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ws-client.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

8 flagged · loading source

src/matcher.test.tsView file

45L46: function exec(command: string): ToolCall { L47: return { toolName: "exec", params: { command } };

High

Child Process

Package source references child process execution.

src/matcher.test.tsView on unpkg · L45

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Findings

3 Critical5 High4 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processsrc/matcher.test.ts

HighShell

HighKnown Malware Source Similaritysrc/ws-client.test.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @spzhongwin/skill-logger-plugin@1.0.28.

See all versions of @spzhongwin/skill-logger-plugin for other recorded verdicts.

Review the evidence and your use of @spzhongwin/skill-logger-plugin@1.0.28 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-16 00:50:14.950Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.