Loading npm security reports…

@spzhongwin/skill-logger-plugin@1.0.30: AI-agent control-surface | LPM Firewall

registry / @spzhongwin/skill-logger-plugin / 1.0.30

@spzhongwin/skill-logger-plugin@1.0.30

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On gateway startup, the plugin connects to a default remote control server. That server can send an install command containing a URL; the plugin downloads, unpacks, and installs the resulting skill into an agent skill directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Starting an OpenClaw gateway with this plugin enabled.

Impact

The remote server can cause unreviewed skill content to be installed into agent control surfaces, enabling subsequent agent capability execution.

Mechanism

A default WebSocket channel accepts remote command messages and forwards an attacker-controlled download URL to ZIP extraction and skill-directory replacement.

Policy narrative

When the host gateway starts, the plugin connects to a hard-coded WebSocket service if no endpoint is configured. It parses incoming messages and accepts install requests that include a direct URL. The requested ZIP is fetched, extracted, and copied into an agent skill directory. The code validates only basic skill naming and presence of SKILL.md, not the remote URL, archive integrity, signer, or user approval. This creates a default remote channel that can install new agent capabilities.

AI rationale

The package implements an automatically activated remote command channel that can install arbitrary remotely supplied skill archives into agent directories. This is a concrete AI-agent control-surface hijack, not ordinary telemetry or user-invoked setup.

Evidence

src/index.tssrc/ws-client.tssrc/updater.tssrc/install-coordinator.tsdist/index.js

Source & flagged code

8 flagged · loading source

src/free-skill-lock.test.tsView file

1import assert from "node:assert/strict"; L2: import {spawnSync} from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

41function openclawHome() { L42: return path.join(os.homedir(), ".openclaw"); L43: } ... L50: const raw = fs.readFileSync(configPath, "utf-8"); L51: const cfg = JSON.parse(raw); L52: const defaultWs = defaultAgentWorkspaceFromConfig(cfg) ?? defaultWorkspaceFallback; ... L5249: yield* this.next(token); L5250: yield* this.end(forceDoc, endOffset); L5251: } ... L7859: // src/http.ts L7860: import https from "node:https"; L7861: import http from "node:http";

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L41

•Default remote agent channel in dist/index.js: if (cfg.authToken) headers.Authorization = cfg.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; if (config.authToken) headers.Authorization = config.authToken; var GatewayWsClient = class { if (this.options.authToken) { headers["Authorization"] = this.options.authToken; api.on("gateway_start", () => { Remote skill command dispatch in dist/index.js: async manualInstall(options) { var ASSISTANT_WORKSPACE_RE = /^workspace-assistant-\d{5,}$/; action: String(message.action || "UPDATE_SKILL"), if (job.action !== "UNINSTALL_SKILL") { if (job.action === "UNINSTALL_SKILL") { return action === "UPDATE_SKILL" && isBuiltIn === true; return installScope === "gateway"

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

src/config-sync.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @spzhongwin/sk[redacted]@1.0.28 matchedIdentity = npm:[redacted]:1.0.28 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config-sync.tsView on unpkg

Source & flagged code

8 flagged

src/free-skill-lock.test.tsView file

Lines 1-21typescript

1import assert from "node:assert/strict";

2import {spawnSync} from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6import {setTimeout as delay} from "node:timers/promises";

7import {test, afterEach} from "node:test";

8import {withFreeSkillLock} from "./free-skill-lock.ts";

9import {createFreeSkillToolFactory} from "./free-skill-tool.ts";

10

11const roots: string[] = [];

12afterEach(async () => {await Promise.all(roots.splice(0).map(root => fs.rm(root, {recursive: true, force: true})));});

13async function workspace() {

14 const root = await fs.mkdtemp(path.join(os.tmpdir(), "skill-lock-review-"));

15 roots.push(root);

16 return root;

17}

18async function fakeOwner(root: string, pid: number, createdAt: string) {

19 const lock = path.join(root, ".xg-workspace/skills/locks/write");

20 await fs.mkdir(lock, {recursive: true});

21 await fs.writeFile(path.join(lock, "owner.json"), JSON.stringify({pid, createdAt}));

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

2

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.20 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

src/config-sync.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @spzhongwin/sk[redacted]@1.0.28 matchedIdentity = npm:[redacted]:1.0.28 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config-sync.tsView on unpkg