registry / @spzhongwin/skill-logger-plugin / 1.1.1

@spzhongwin/skill-logger-plugin@1.1.1

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The package implements a remotely controlled agent-extension installation channel activated during normal gateway operation. This is a concrete platform extension lifecycle risk, but the inspected source does not show npm lifecycle abuse or a confirmed malicious payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the configured OpenClaw gateway, followed by an INSTALL_EXPERT WebSocket message.

Impact

A connected service can introduce or replace agent expert instructions and related capabilities. No npm install-time attack was identified.

Mechanism

The extension connects with its configured token, accepts a download URL from the message, downloads and unzips the archive, then replaces the expert directory.

AI rationale

Evidence

src/index.tssrc/ws-client.tssrc/updater.ts

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an OpenClaw extension entry point.
On gateway startup it creates a central WebSocket client and connects automatically.
When no endpoint is configured, it uses a fixed aishuo.co WebSocket endpoint and passes the configured authorization token to the client.
The WebSocket client sends that token as an Authorization header.
A received INSTALL_EXPERT command downloads a supplied archive and installs its extracted expert files into an agent workspace.

Evidence against

There are no npm preinstall, install, or postinstall lifecycle hooks.
The archive installer requires an expert root containing both AGENTS.md and SOUL.md, but this is not a content integrity or origin check.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

9 flagged

src/free-skill-lock.test.tsView file

Lines 1-21typescript

1import assert from "node:assert/strict";

2import {spawnSync} from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6import {setTimeout as delay} from "node:timers/promises";

7import {test, afterEach} from "node:test";

8import {withFreeSkillLock} from "./free-skill-lock.ts";

9import {createFreeSkillToolFactory} from "./free-skill-tool.ts";

11const roots: string[] = [];

12afterEach(async () => {await Promise.all(roots.splice(0).map(root => fs.rm(root, {recursive: true, force: true})));});

13async function workspace() {

14 const root = await fs.mkdtemp(path.join(os.tmpdir(), "skill-lock-review-"));

15 roots.push(root);

16 return root;

17}

18async function fakeOwner(root: string, pid: number, createdAt: string) {

19 const lock = path.join(root, ".xg-workspace/skills/locks/write");

20 await fs.mkdir(lock, {recursive: true});

21 await fs.writeFile(path.join(lock, "owner.json"), JSON.stringify({pid, createdAt}));

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/ws-client.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/ws-client.test.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ws-client.test.tsView on unpkg

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

9 flagged · loading source

src/free-skill-lock.test.tsView file

1import assert from "node:assert/strict"; L2: import {spawnSync} from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

Findings

3 Critical5 High4 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processsrc/free-skill-lock.test.ts

HighKnown Malware Source Similaritysrc/config-sync.ts

HighKnown Malware Source Similaritysrc/ws-client.test.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @spzhongwin/skill-logger-plugin@1.1.1.

See all versions of @spzhongwin/skill-logger-plugin for other recorded verdicts.

Review the evidence and your use of @spzhongwin/skill-logger-plugin@1.1.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:20:59.454Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.