registry / @spzhongwin/skill-logger-plugin / 1.1.0

@spzhongwin/skill-logger-plugin@1.1.0

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no npm install-time hook, but its active extension lifecycle creates a remotely controlled skill deployment channel. The remote URL and resulting agent-control-surface mutation are concrete enough to warrant a warning.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

OpenClaw gateway_start followed by an INSTALL_SKILL command from the WebSocket service.

Impact

A controlling service or compromised connection can remotely alter agent skills and thereby change the agent control surface.

Mechanism

The WebSocket handler forwards the command URL to the updater, which downloads, extracts, and replaces a platform skill directory.

AI rationale

Evidence

src/index.tssrc/ws-client.tssrc/updater.ts

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

On gateway startup, the extension defaults to a persistent WebSocket connection to a package-selected central service and supplies the configured authentication token.
Messages received over that WebSocket are parsed and dispatched directly to the command handler.
An INSTALL_SKILL message can pass its URL directly to the installer for a gateway or agent skill directory.
The installer fetches the supplied archive, unpacks it, and replaces the target skill directory; its optional hash checks are identity/version checks rather than archive-content verification.

Evidence against

package.json has no npm install, preinstall, or postinstall lifecycle hook; prepublishOnly is publish-time only.
Skill codes are restricted to a platform namespace and path-like codes are rejected.
The reported base64 decoding in dist/index.js is bundled YAML parsing code, not dynamic payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

10 flagged

src/free-skill-lock.test.tsView file

Lines 1-21typescript

1import assert from "node:assert/strict";

2import {spawnSync} from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6import {setTimeout as delay} from "node:timers/promises";

7import {test, afterEach} from "node:test";

8import {withFreeSkillLock} from "./free-skill-lock.ts";

9import {createFreeSkillToolFactory} from "./free-skill-tool.ts";

11const roots: string[] = [];

12afterEach(async () => {await Promise.all(roots.splice(0).map(root => fs.rm(root, {recursive: true, force: true})));});

13async function workspace() {

14 const root = await fs.mkdtemp(path.join(os.tmpdir(), "skill-lock-review-"));

15 roots.push(root);

16 return root;

17}

18async function fakeOwner(root: string, pid: number, createdAt: string) {

19 const lock = path.join(root, ".xg-workspace/skills/locks/write");

20 await fs.mkdir(lock, {recursive: true});

21 await fs.writeFile(path.join(lock, "owner.json"), JSON.stringify({pid, createdAt}));

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/config-sync.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @spzhongwin/sk[redacted]@1.0.28 matchedIdentity = npm:[redacted]:1.0.28 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config-sync.tsView on unpkg

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/ws-client.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/ws-client.test.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ws-client.test.tsView on unpkg

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

10 flagged · loading source

src/free-skill-lock.test.tsView file

1import assert from "node:assert/strict"; L2: import {spawnSync} from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

Findings

4 Critical5 High4 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltasrc/config-sync.ts

HighChild Processsrc/free-skill-lock.test.ts

HighKnown Malware Source Similaritysrc/config-sync.ts

HighKnown Malware Source Similaritysrc/ws-client.test.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @spzhongwin/skill-logger-plugin@1.1.0.

See all versions of @spzhongwin/skill-logger-plugin for other recorded verdicts.

Review the evidence and your use of @spzhongwin/skill-logger-plugin@1.1.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 20:00:48.311Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.